xmrig | 6a95b6dca2e94e565466a4c45ab43c7d08f93b7d86b096c0160f5c50f064aaf6

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

914539025dc43d076db91c4347629700_NeikiAnalytics.exe
Size

1.8MB
MD5

914539025dc43d076db91c4347629700
SHA1

943c50ccdbd909cda22f4b6ac38b178e01a0494d
SHA256

6a95b6dca2e94e565466a4c45ab43c7d08f93b7d86b096c0160f5c50f064aaf6
SHA512

bd393cf4367c80c6b4851d8320b395af7bdca3ae04652eecedfef0b29305c92763bb7c47292240070567725479ca796528920cec51e6d8bf078755ae95ebd997
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zT:Lz071uv4BPMkibTIA5lCx7kvRWa4pUF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2708-41-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2108-38-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2016-68-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2532-67-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2164-84-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2668-73-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/3036-70-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/1252-39-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/2916-962-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2560-964-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2708-4466-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2532-7306-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2164-7305-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2560-7307-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2752-7649-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2588-7650-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2016-7658-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/1252-7679-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/2668-7652-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2108-7681-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1964	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2108	MmhAICd.exe
1252	eFLmLYn.exe
2708	bPRkdvA.exe
3036	lkIBEMx.exe
2560	yQCBSdy.exe
2532	EdcvMfg.exe
2668	yUZSWws.exe
2016	dCwRWjz.exe
2164	hdmYrEj.exe
2752	KqWyiRK.exe
2588	PkSeBid.exe
2828	rUnmuff.exe
1608	fOEMKNC.exe
1868	fhmLLDV.exe
1932	UtGfodE.exe
1952	thylxib.exe
756	AfFCGzv.exe
796	ftDvZOW.exe
1944	JQXdLvQ.exe
2980	zPeIfwR.exe
2136	PZYwJgp.exe
2144	wSDCAvI.exe
2260	johVWRd.exe
2900	RDHXFcn.exe
1612	CASHPBm.exe
632	fynhAGJ.exe
2216	CLjOEwp.exe
2352	igMPnfQ.exe
1384	zJvVeOj.exe
2480	RSvHqCO.exe
1100	okafuNY.exe
2356	symZGvC.exe
900	hiLessg.exe
1540	uWWWaJB.exe
2056	xuHqWty.exe
2036	MSglKaw.exe
1036	shhlgCR.exe
1088	sfTLFAL.exe
2272	iXARCYz.exe
2724	uKXGvdZ.exe
1856	XeJYhxd.exe
1568	Uxsyfxz.exe
468	iyNOooQ.exe
1656	UVGMUFX.exe
1320	JJpwMNN.exe
1160	HoHErXY.exe
952	rwhkkru.exe
1064	YmFcVlf.exe
2436	iDuKrEJ.exe
2340	zzMxIuZ.exe
1748	CCmNjeL.exe
2968	VTYTopL.exe
1592	EbqbAyd.exe
2368	CSIgmBT.exe
2792	WhuxgWR.exe
2448	WxbMGxr.exe
2796	Hdqtqnw.exe
2696	PXwTwPt.exe
2572	acBaZoh.exe
1644	OwkohrX.exe
1860	REQjdJq.exe
2624	yLCLdmP.exe
372	EnrHtbi.exe
2200	LMpAtEs.exe

Loads dropped DLL 64 IoCs

pid	Process
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2916-0-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x0037000000016133-10.dat	upx
behavioral1/files/0x000e00000001214d-3.dat	upx
behavioral1/files/0x000f000000003683-17.dat	upx
behavioral1/files/0x0008000000016824-21.dat	upx
behavioral1/files/0x0007000000016a7d-26.dat	upx
behavioral1/files/0x0007000000016caf-45.dat	upx
behavioral1/files/0x0006000000016d78-52.dat	upx
behavioral1/memory/2708-41-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2108-38-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2016-68-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/files/0x0006000000016dc8-90.dat	upx
behavioral1/files/0x0006000000016db2-77.dat	upx
behavioral1/files/0x00060000000171ba-101.dat	upx
behavioral1/files/0x00060000000173b4-112.dat	upx
behavioral1/files/0x00060000000173d6-119.dat	upx
behavioral1/files/0x0007000000016c4a-29.dat	upx
behavioral1/memory/2532-67-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x0006000000016dd1-123.dat	upx
behavioral1/files/0x00060000000173d3-125.dat	upx
behavioral1/files/0x000600000001720f-124.dat	upx
behavioral1/memory/2164-84-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x00060000000175e8-132.dat	upx
behavioral1/files/0x00370000000162cc-79.dat	upx
behavioral1/memory/2668-73-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/3036-70-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2560-65-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x0006000000016da0-55.dat	upx
behavioral1/files/0x0007000000016d70-49.dat	upx
behavioral1/memory/1252-39-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/files/0x00050000000186ff-144.dat	upx
behavioral1/files/0x000500000001870d-151.dat	upx
behavioral1/files/0x000500000001873a-158.dat	upx
behavioral1/files/0x0006000000018b73-172.dat	upx
behavioral1/files/0x000500000001878b-165.dat	upx
behavioral1/files/0x0005000000019296-186.dat	upx
behavioral1/files/0x00050000000187a2-167.dat	upx
behavioral1/files/0x0005000000018784-160.dat	upx
behavioral1/files/0x0005000000019349-188.dat	upx
behavioral1/files/0x00060000000190d6-181.dat	upx
behavioral1/files/0x0006000000018bc6-174.dat	upx
behavioral1/files/0x0005000000018711-153.dat	upx
behavioral1/files/0x0005000000018701-146.dat	upx
behavioral1/files/0x00060000000175f4-139.dat	upx
behavioral1/files/0x0006000000017568-126.dat	upx
behavioral1/memory/2588-89-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2752-88-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/files/0x0006000000018bda-179.dat	upx
behavioral1/memory/2916-962-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/2560-964-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2708-4466-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2532-7306-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2164-7305-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2560-7307-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2752-7649-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2588-7650-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2016-7658-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/1252-7679-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/memory/2668-7652-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2108-7681-0x000000013F450000-0x000000013F842000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zYnUWZA.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\NuonNEk.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\vyrByzs.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\qEiQDnY.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\dBggMWp.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\aOYpFGg.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\LHCGTMP.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\QxfaRRe.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\gXngCPv.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\AEoWsOl.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\tYKVrXQ.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\ImRufqg.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\KoLlvTM.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\uVrMDYS.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\icgefsK.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\JNpiBvd.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\hvCquKi.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\BeoWEeP.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\IhPYfIz.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\aPneFAC.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\WkPqXGG.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\VrPFxIh.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\nahPaCY.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\fFZUsiM.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\oZXvfBQ.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\rukOurf.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\txtlcZZ.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\YxZXoqp.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\TgXSzJy.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\pknFTcI.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\ZHwrsiq.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\Lktoqmb.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\Bputdqi.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\GwcztqQ.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\mavkaAf.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\GWKtAzu.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\bhFbaDX.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\MasfoGK.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\trHerTf.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\rQlzqNL.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\vVGCywg.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\vOhSlkB.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\FRoagYn.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\tkkrzvo.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\wEyUJJK.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\Hufpynt.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\iXzQzwJ.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\WEXhyHi.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\yyqZtsC.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\WMjtkUm.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\TfzsTng.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\CvyHNzO.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\hdFimIy.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\KnpblLB.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\GLOYcne.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\gBvXelR.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\JeHpaQs.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\DxAQpQq.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\TdOFWOi.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\qLtFgEX.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\ABjiOBT.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\HPLmiyV.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\jsTzDrC.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\cedJraJ.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1964	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
Token: SeDebugPrivilege	1964	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1964	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	29
PID 2916 wrote to memory of 1964	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	29
PID 2916 wrote to memory of 1964	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	29
PID 2916 wrote to memory of 2108	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	30
PID 2916 wrote to memory of 2108	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	30
PID 2916 wrote to memory of 2108	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	30
PID 2916 wrote to memory of 1252	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	31
PID 2916 wrote to memory of 1252	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	31
PID 2916 wrote to memory of 1252	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	31
PID 2916 wrote to memory of 2708	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	32
PID 2916 wrote to memory of 2708	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	32
PID 2916 wrote to memory of 2708	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	32
PID 2916 wrote to memory of 2668	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	33
PID 2916 wrote to memory of 2668	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	33
PID 2916 wrote to memory of 2668	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	33
PID 2916 wrote to memory of 3036	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	34
PID 2916 wrote to memory of 3036	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	34
PID 2916 wrote to memory of 3036	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	34
PID 2916 wrote to memory of 2016	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	35
PID 2916 wrote to memory of 2016	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	35
PID 2916 wrote to memory of 2016	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	35
PID 2916 wrote to memory of 2560	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	36
PID 2916 wrote to memory of 2560	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	36
PID 2916 wrote to memory of 2560	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	36
PID 2916 wrote to memory of 2752	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	37
PID 2916 wrote to memory of 2752	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	37
PID 2916 wrote to memory of 2752	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	37
PID 2916 wrote to memory of 2532	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	38
PID 2916 wrote to memory of 2532	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	38
PID 2916 wrote to memory of 2532	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	38
PID 2916 wrote to memory of 2588	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	39
PID 2916 wrote to memory of 2588	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	39
PID 2916 wrote to memory of 2588	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	39
PID 2916 wrote to memory of 2164	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	40
PID 2916 wrote to memory of 2164	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	40
PID 2916 wrote to memory of 2164	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	40
PID 2916 wrote to memory of 1608	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	41
PID 2916 wrote to memory of 1608	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	41
PID 2916 wrote to memory of 1608	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	41
PID 2916 wrote to memory of 2828	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	42
PID 2916 wrote to memory of 2828	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	42
PID 2916 wrote to memory of 2828	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	42
PID 2916 wrote to memory of 756	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	43
PID 2916 wrote to memory of 756	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	43
PID 2916 wrote to memory of 756	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	43
PID 2916 wrote to memory of 1868	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	44
PID 2916 wrote to memory of 1868	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	44
PID 2916 wrote to memory of 1868	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	44
PID 2916 wrote to memory of 796	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	45
PID 2916 wrote to memory of 796	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	45
PID 2916 wrote to memory of 796	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	45
PID 2916 wrote to memory of 1932	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	46
PID 2916 wrote to memory of 1932	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	46
PID 2916 wrote to memory of 1932	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	46
PID 2916 wrote to memory of 1944	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	47
PID 2916 wrote to memory of 1944	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	47
PID 2916 wrote to memory of 1944	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	47
PID 2916 wrote to memory of 1952	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	48
PID 2916 wrote to memory of 1952	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	48
PID 2916 wrote to memory of 1952	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	48
PID 2916 wrote to memory of 2980	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	49
PID 2916 wrote to memory of 2980	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	49
PID 2916 wrote to memory of 2980	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	49
PID 2916 wrote to memory of 2136	2916	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\914539025dc43d076db91c4347629700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\914539025dc43d076db91c4347629700_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\System\MmhAICd.exe
  C:\Windows\System\MmhAICd.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\eFLmLYn.exe
  C:\Windows\System\eFLmLYn.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\bPRkdvA.exe
  C:\Windows\System\bPRkdvA.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\yUZSWws.exe
  C:\Windows\System\yUZSWws.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\lkIBEMx.exe
  C:\Windows\System\lkIBEMx.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\dCwRWjz.exe
  C:\Windows\System\dCwRWjz.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\yQCBSdy.exe
  C:\Windows\System\yQCBSdy.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\KqWyiRK.exe
  C:\Windows\System\KqWyiRK.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\EdcvMfg.exe
  C:\Windows\System\EdcvMfg.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\PkSeBid.exe
  C:\Windows\System\PkSeBid.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\hdmYrEj.exe
  C:\Windows\System\hdmYrEj.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\fOEMKNC.exe
  C:\Windows\System\fOEMKNC.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\rUnmuff.exe
  C:\Windows\System\rUnmuff.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\AfFCGzv.exe
  C:\Windows\System\AfFCGzv.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\fhmLLDV.exe
  C:\Windows\System\fhmLLDV.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\ftDvZOW.exe
  C:\Windows\System\ftDvZOW.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\UtGfodE.exe
  C:\Windows\System\UtGfodE.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\JQXdLvQ.exe
  C:\Windows\System\JQXdLvQ.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\thylxib.exe
  C:\Windows\System\thylxib.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\zPeIfwR.exe
  C:\Windows\System\zPeIfwR.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\PZYwJgp.exe
  C:\Windows\System\PZYwJgp.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\MSglKaw.exe
  C:\Windows\System\MSglKaw.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\wSDCAvI.exe
  C:\Windows\System\wSDCAvI.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\shhlgCR.exe
  C:\Windows\System\shhlgCR.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\johVWRd.exe
  C:\Windows\System\johVWRd.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\sfTLFAL.exe
  C:\Windows\System\sfTLFAL.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\RDHXFcn.exe
  C:\Windows\System\RDHXFcn.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\iXARCYz.exe
  C:\Windows\System\iXARCYz.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\CASHPBm.exe
  C:\Windows\System\CASHPBm.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\uKXGvdZ.exe
  C:\Windows\System\uKXGvdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\fynhAGJ.exe
  C:\Windows\System\fynhAGJ.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\XeJYhxd.exe
  C:\Windows\System\XeJYhxd.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\CLjOEwp.exe
  C:\Windows\System\CLjOEwp.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\Uxsyfxz.exe
  C:\Windows\System\Uxsyfxz.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\igMPnfQ.exe
  C:\Windows\System\igMPnfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\iyNOooQ.exe
  C:\Windows\System\iyNOooQ.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\zJvVeOj.exe
  C:\Windows\System\zJvVeOj.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\UVGMUFX.exe
  C:\Windows\System\UVGMUFX.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\RSvHqCO.exe
  C:\Windows\System\RSvHqCO.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\JJpwMNN.exe
  C:\Windows\System\JJpwMNN.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\okafuNY.exe
  C:\Windows\System\okafuNY.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\HoHErXY.exe
  C:\Windows\System\HoHErXY.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\symZGvC.exe
  C:\Windows\System\symZGvC.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\rwhkkru.exe
  C:\Windows\System\rwhkkru.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\hiLessg.exe
  C:\Windows\System\hiLessg.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\iDuKrEJ.exe
  C:\Windows\System\iDuKrEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\uWWWaJB.exe
  C:\Windows\System\uWWWaJB.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\zzMxIuZ.exe
  C:\Windows\System\zzMxIuZ.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\xuHqWty.exe
  C:\Windows\System\xuHqWty.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\CCmNjeL.exe
  C:\Windows\System\CCmNjeL.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\YmFcVlf.exe
  C:\Windows\System\YmFcVlf.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\EbqbAyd.exe
  C:\Windows\System\EbqbAyd.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\VTYTopL.exe
  C:\Windows\System\VTYTopL.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\CSIgmBT.exe
  C:\Windows\System\CSIgmBT.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\WhuxgWR.exe
  C:\Windows\System\WhuxgWR.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\WxbMGxr.exe
  C:\Windows\System\WxbMGxr.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\Hdqtqnw.exe
  C:\Windows\System\Hdqtqnw.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\PXwTwPt.exe
  C:\Windows\System\PXwTwPt.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\acBaZoh.exe
  C:\Windows\System\acBaZoh.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\OwkohrX.exe
  C:\Windows\System\OwkohrX.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\REQjdJq.exe
  C:\Windows\System\REQjdJq.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\LMpAtEs.exe
  C:\Windows\System\LMpAtEs.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\yLCLdmP.exe
  C:\Windows\System\yLCLdmP.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\CZCiCLA.exe
  C:\Windows\System\CZCiCLA.exe
  2⤵
  PID:1636
- C:\Windows\System\EnrHtbi.exe
  C:\Windows\System\EnrHtbi.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\QFjOwgS.exe
  C:\Windows\System\QFjOwgS.exe
  2⤵
  PID:1504
- C:\Windows\System\HaFGEtf.exe
  C:\Windows\System\HaFGEtf.exe
  2⤵
  PID:2256
- C:\Windows\System\zCsOvkS.exe
  C:\Windows\System\zCsOvkS.exe
  2⤵
  PID:1300
- C:\Windows\System\BBbkgXW.exe
  C:\Windows\System\BBbkgXW.exe
  2⤵
  PID:2888
- C:\Windows\System\DjKVnjd.exe
  C:\Windows\System\DjKVnjd.exe
  2⤵
  PID:1836
- C:\Windows\System\thKmeHg.exe
  C:\Windows\System\thKmeHg.exe
  2⤵
  PID:896
- C:\Windows\System\gKRVWyF.exe
  C:\Windows\System\gKRVWyF.exe
  2⤵
  PID:568
- C:\Windows\System\JxgDBUM.exe
  C:\Windows\System\JxgDBUM.exe
  2⤵
  PID:2052
- C:\Windows\System\ihcjQcu.exe
  C:\Windows\System\ihcjQcu.exe
  2⤵
  PID:2524
- C:\Windows\System\HlSFuAX.exe
  C:\Windows\System\HlSFuAX.exe
  2⤵
  PID:2564
- C:\Windows\System\qPbxtJU.exe
  C:\Windows\System\qPbxtJU.exe
  2⤵
  PID:2688
- C:\Windows\System\gEKMffk.exe
  C:\Windows\System\gEKMffk.exe
  2⤵
  PID:856
- C:\Windows\System\OCtyWCO.exe
  C:\Windows\System\OCtyWCO.exe
  2⤵
  PID:2084
- C:\Windows\System\dbaEAbI.exe
  C:\Windows\System\dbaEAbI.exe
  2⤵
  PID:2860
- C:\Windows\System\dmMAeuT.exe
  C:\Windows\System\dmMAeuT.exe
  2⤵
  PID:1368
- C:\Windows\System\tsPVXnw.exe
  C:\Windows\System\tsPVXnw.exe
  2⤵
  PID:2652
- C:\Windows\System\yuuPPjH.exe
  C:\Windows\System\yuuPPjH.exe
  2⤵
  PID:2024
- C:\Windows\System\FlzGdeE.exe
  C:\Windows\System\FlzGdeE.exe
  2⤵
  PID:1780
- C:\Windows\System\YSSGZHh.exe
  C:\Windows\System\YSSGZHh.exe
  2⤵
  PID:1048
- C:\Windows\System\YeurSyB.exe
  C:\Windows\System\YeurSyB.exe
  2⤵
  PID:2068
- C:\Windows\System\rGxQFbu.exe
  C:\Windows\System\rGxQFbu.exe
  2⤵
  PID:3040
- C:\Windows\System\RfnHGCG.exe
  C:\Windows\System\RfnHGCG.exe
  2⤵
  PID:2324
- C:\Windows\System\RODnuDg.exe
  C:\Windows\System\RODnuDg.exe
  2⤵
  PID:2768
- C:\Windows\System\rDxSyUV.exe
  C:\Windows\System\rDxSyUV.exe
  2⤵
  PID:880
- C:\Windows\System\qeaqoXZ.exe
  C:\Windows\System\qeaqoXZ.exe
  2⤵
  PID:1280
- C:\Windows\System\SlHnExs.exe
  C:\Windows\System\SlHnExs.exe
  2⤵
  PID:2604
- C:\Windows\System\AYPWjmu.exe
  C:\Windows\System\AYPWjmu.exe
  2⤵
  PID:1564
- C:\Windows\System\cWrWfhX.exe
  C:\Windows\System\cWrWfhX.exe
  2⤵
  PID:2656
- C:\Windows\System\oqHHPmR.exe
  C:\Windows\System\oqHHPmR.exe
  2⤵
  PID:2464
- C:\Windows\System\OzqQQTX.exe
  C:\Windows\System\OzqQQTX.exe
  2⤵
  PID:2844
- C:\Windows\System\yYxHnEl.exe
  C:\Windows\System\yYxHnEl.exe
  2⤵
  PID:1536
- C:\Windows\System\nkBuPGy.exe
  C:\Windows\System\nkBuPGy.exe
  2⤵
  PID:2184
- C:\Windows\System\halwLib.exe
  C:\Windows\System\halwLib.exe
  2⤵
  PID:1484
- C:\Windows\System\RJRtOHp.exe
  C:\Windows\System\RJRtOHp.exe
  2⤵
  PID:2288
- C:\Windows\System\oodnbYn.exe
  C:\Windows\System\oodnbYn.exe
  2⤵
  PID:2636
- C:\Windows\System\DZRXWBA.exe
  C:\Windows\System\DZRXWBA.exe
  2⤵
  PID:2940
- C:\Windows\System\HSZYwta.exe
  C:\Windows\System\HSZYwta.exe
  2⤵
  PID:3024
- C:\Windows\System\rdJuabv.exe
  C:\Windows\System\rdJuabv.exe
  2⤵
  PID:1500
- C:\Windows\System\mmJBPYm.exe
  C:\Windows\System\mmJBPYm.exe
  2⤵
  PID:2628
- C:\Windows\System\VVAWnJy.exe
  C:\Windows\System\VVAWnJy.exe
  2⤵
  PID:832
- C:\Windows\System\OYMwckx.exe
  C:\Windows\System\OYMwckx.exe
  2⤵
  PID:2316
- C:\Windows\System\ywoRyvF.exe
  C:\Windows\System\ywoRyvF.exe
  2⤵
  PID:2508
- C:\Windows\System\CXaHTSM.exe
  C:\Windows\System\CXaHTSM.exe
  2⤵
  PID:2140
- C:\Windows\System\nPOSJJf.exe
  C:\Windows\System\nPOSJJf.exe
  2⤵
  PID:2092
- C:\Windows\System\AcPpLWj.exe
  C:\Windows\System\AcPpLWj.exe
  2⤵
  PID:2972
- C:\Windows\System\SAmyOeA.exe
  C:\Windows\System\SAmyOeA.exe
  2⤵
  PID:2496
- C:\Windows\System\BrfWGid.exe
  C:\Windows\System\BrfWGid.exe
  2⤵
  PID:1304
- C:\Windows\System\oifhEMP.exe
  C:\Windows\System\oifhEMP.exe
  2⤵
  PID:1720
- C:\Windows\System\tdiQjEz.exe
  C:\Windows\System\tdiQjEz.exe
  2⤵
  PID:2188
- C:\Windows\System\uSPLtQq.exe
  C:\Windows\System\uSPLtQq.exe
  2⤵
  PID:1028
- C:\Windows\System\SKCtcjG.exe
  C:\Windows\System\SKCtcjG.exe
  2⤵
  PID:1796
- C:\Windows\System\uDEZGLj.exe
  C:\Windows\System\uDEZGLj.exe
  2⤵
  PID:2264
- C:\Windows\System\zOKQgAt.exe
  C:\Windows\System\zOKQgAt.exe
  2⤵
  PID:1784
- C:\Windows\System\CojIHBj.exe
  C:\Windows\System\CojIHBj.exe
  2⤵
  PID:2388
- C:\Windows\System\xvWasAf.exe
  C:\Windows\System\xvWasAf.exe
  2⤵
  PID:2880
- C:\Windows\System\DDEYDFj.exe
  C:\Windows\System\DDEYDFj.exe
  2⤵
  PID:2096
- C:\Windows\System\NZhmFlj.exe
  C:\Windows\System\NZhmFlj.exe
  2⤵
  PID:2408
- C:\Windows\System\fRItVFu.exe
  C:\Windows\System\fRItVFu.exe
  2⤵
  PID:1488
- C:\Windows\System\gvVQoEc.exe
  C:\Windows\System\gvVQoEc.exe
  2⤵
  PID:2664
- C:\Windows\System\SKzEZGc.exe
  C:\Windows\System\SKzEZGc.exe
  2⤵
  PID:2220
- C:\Windows\System\ktqcRlb.exe
  C:\Windows\System\ktqcRlb.exe
  2⤵
  PID:1740
- C:\Windows\System\fgNIzta.exe
  C:\Windows\System\fgNIzta.exe
  2⤵
  PID:776
- C:\Windows\System\qyQnWeE.exe
  C:\Windows\System\qyQnWeE.exe
  2⤵
  PID:868
- C:\Windows\System\DnYzjGV.exe
  C:\Windows\System\DnYzjGV.exe
  2⤵
  PID:2492
- C:\Windows\System\PgJaIEY.exe
  C:\Windows\System\PgJaIEY.exe
  2⤵
  PID:552
- C:\Windows\System\ksLGSgB.exe
  C:\Windows\System\ksLGSgB.exe
  2⤵
  PID:3128
- C:\Windows\System\OoUvFeb.exe
  C:\Windows\System\OoUvFeb.exe
  2⤵
  PID:3144
- C:\Windows\System\GIQdROA.exe
  C:\Windows\System\GIQdROA.exe
  2⤵
  PID:3212
- C:\Windows\System\sYlGFFp.exe
  C:\Windows\System\sYlGFFp.exe
  2⤵
  PID:3232
- C:\Windows\System\WyBgyWE.exe
  C:\Windows\System\WyBgyWE.exe
  2⤵
  PID:3248
- C:\Windows\System\IMZIkfs.exe
  C:\Windows\System\IMZIkfs.exe
  2⤵
  PID:3264
- C:\Windows\System\KoLlvTM.exe
  C:\Windows\System\KoLlvTM.exe
  2⤵
  PID:3292
- C:\Windows\System\cMITehb.exe
  C:\Windows\System\cMITehb.exe
  2⤵
  PID:3308
- C:\Windows\System\FjkVnky.exe
  C:\Windows\System\FjkVnky.exe
  2⤵
  PID:3328
- C:\Windows\System\FISHYvB.exe
  C:\Windows\System\FISHYvB.exe
  2⤵
  PID:3348
- C:\Windows\System\EauoICo.exe
  C:\Windows\System\EauoICo.exe
  2⤵
  PID:3364
- C:\Windows\System\cWYkLAc.exe
  C:\Windows\System\cWYkLAc.exe
  2⤵
  PID:3380
- C:\Windows\System\ylWlvZR.exe
  C:\Windows\System\ylWlvZR.exe
  2⤵
  PID:3396
- C:\Windows\System\XWCFKOc.exe
  C:\Windows\System\XWCFKOc.exe
  2⤵
  PID:3420
- C:\Windows\System\ODDArDy.exe
  C:\Windows\System\ODDArDy.exe
  2⤵
  PID:3448
- C:\Windows\System\zzDIuWx.exe
  C:\Windows\System\zzDIuWx.exe
  2⤵
  PID:3464
- C:\Windows\System\iSWiYPt.exe
  C:\Windows\System\iSWiYPt.exe
  2⤵
  PID:3484
- C:\Windows\System\CdLsHtX.exe
  C:\Windows\System\CdLsHtX.exe
  2⤵
  PID:3500
- C:\Windows\System\KaVhlAJ.exe
  C:\Windows\System\KaVhlAJ.exe
  2⤵
  PID:3516
- C:\Windows\System\GOqhVvF.exe
  C:\Windows\System\GOqhVvF.exe
  2⤵
  PID:3536
- C:\Windows\System\doixylX.exe
  C:\Windows\System\doixylX.exe
  2⤵
  PID:3560
- C:\Windows\System\GRfvHAW.exe
  C:\Windows\System\GRfvHAW.exe
  2⤵
  PID:3576
- C:\Windows\System\yLAMPOe.exe
  C:\Windows\System\yLAMPOe.exe
  2⤵
  PID:3592
- C:\Windows\System\cwaFSFL.exe
  C:\Windows\System\cwaFSFL.exe
  2⤵
  PID:3612
- C:\Windows\System\LecmtOj.exe
  C:\Windows\System\LecmtOj.exe
  2⤵
  PID:3628
- C:\Windows\System\ZdeZyTL.exe
  C:\Windows\System\ZdeZyTL.exe
  2⤵
  PID:3644
- C:\Windows\System\jODhmEz.exe
  C:\Windows\System\jODhmEz.exe
  2⤵
  PID:3660
- C:\Windows\System\UdCZXGy.exe
  C:\Windows\System\UdCZXGy.exe
  2⤵
  PID:3680
- C:\Windows\System\NEdpEHv.exe
  C:\Windows\System\NEdpEHv.exe
  2⤵
  PID:3696
- C:\Windows\System\KoZEFDJ.exe
  C:\Windows\System\KoZEFDJ.exe
  2⤵
  PID:3712
- C:\Windows\System\fgGqAmi.exe
  C:\Windows\System\fgGqAmi.exe
  2⤵
  PID:3728
- C:\Windows\System\mavkaAf.exe
  C:\Windows\System\mavkaAf.exe
  2⤵
  PID:3744
- C:\Windows\System\IbLvXYx.exe
  C:\Windows\System\IbLvXYx.exe
  2⤵
  PID:3760
- C:\Windows\System\wOgJwXJ.exe
  C:\Windows\System\wOgJwXJ.exe
  2⤵
  PID:3776
- C:\Windows\System\gfNMJdR.exe
  C:\Windows\System\gfNMJdR.exe
  2⤵
  PID:3792
- C:\Windows\System\pHKyUEi.exe
  C:\Windows\System\pHKyUEi.exe
  2⤵
  PID:3808
- C:\Windows\System\wkizOlW.exe
  C:\Windows\System\wkizOlW.exe
  2⤵
  PID:3824
- C:\Windows\System\sIylsny.exe
  C:\Windows\System\sIylsny.exe
  2⤵
  PID:3840
- C:\Windows\System\UfhmBbK.exe
  C:\Windows\System\UfhmBbK.exe
  2⤵
  PID:3856
- C:\Windows\System\piPMnSZ.exe
  C:\Windows\System\piPMnSZ.exe
  2⤵
  PID:3872
- C:\Windows\System\otsJZeQ.exe
  C:\Windows\System\otsJZeQ.exe
  2⤵
  PID:3888
- C:\Windows\System\vinYiPT.exe
  C:\Windows\System\vinYiPT.exe
  2⤵
  PID:3904
- C:\Windows\System\aevQgSZ.exe
  C:\Windows\System\aevQgSZ.exe
  2⤵
  PID:3920
- C:\Windows\System\ViECArT.exe
  C:\Windows\System\ViECArT.exe
  2⤵
  PID:3940
- C:\Windows\System\kGiAWpu.exe
  C:\Windows\System\kGiAWpu.exe
  2⤵
  PID:3964
- C:\Windows\System\gupKPue.exe
  C:\Windows\System\gupKPue.exe
  2⤵
  PID:3980
- C:\Windows\System\elLVmlm.exe
  C:\Windows\System\elLVmlm.exe
  2⤵
  PID:3996
- C:\Windows\System\kegTFyz.exe
  C:\Windows\System\kegTFyz.exe
  2⤵
  PID:4012
- C:\Windows\System\qEiQDnY.exe
  C:\Windows\System\qEiQDnY.exe
  2⤵
  PID:4028
- C:\Windows\System\OFvYNVx.exe
  C:\Windows\System\OFvYNVx.exe
  2⤵
  PID:4044
- C:\Windows\System\cqKXzRH.exe
  C:\Windows\System\cqKXzRH.exe
  2⤵
  PID:4060
- C:\Windows\System\XyClGIB.exe
  C:\Windows\System\XyClGIB.exe
  2⤵
  PID:4076
- C:\Windows\System\ZzslDKy.exe
  C:\Windows\System\ZzslDKy.exe
  2⤵
  PID:4092
- C:\Windows\System\JTuMIkc.exe
  C:\Windows\System\JTuMIkc.exe
  2⤵
  PID:1764
- C:\Windows\System\ZodpsGH.exe
  C:\Windows\System\ZodpsGH.exe
  2⤵
  PID:1820
- C:\Windows\System\HCdUwcx.exe
  C:\Windows\System\HCdUwcx.exe
  2⤵
  PID:1256
- C:\Windows\System\dUAIMmt.exe
  C:\Windows\System\dUAIMmt.exe
  2⤵
  PID:2240
- C:\Windows\System\YKaZiPs.exe
  C:\Windows\System\YKaZiPs.exe
  2⤵
  PID:2380
- C:\Windows\System\TjrcXfK.exe
  C:\Windows\System\TjrcXfK.exe
  2⤵
  PID:2840
- C:\Windows\System\beDsFYj.exe
  C:\Windows\System\beDsFYj.exe
  2⤵
  PID:1376
- C:\Windows\System\bavZSaP.exe
  C:\Windows\System\bavZSaP.exe
  2⤵
  PID:1584
- C:\Windows\System\qpkcJqr.exe
  C:\Windows\System\qpkcJqr.exe
  2⤵
  PID:1716
- C:\Windows\System\AfZklSB.exe
  C:\Windows\System\AfZklSB.exe
  2⤵
  PID:3088
- C:\Windows\System\rdwkzEm.exe
  C:\Windows\System\rdwkzEm.exe
  2⤵
  PID:2548
- C:\Windows\System\tYKVrXQ.exe
  C:\Windows\System\tYKVrXQ.exe
  2⤵
  PID:3224
- C:\Windows\System\ESHpLZx.exe
  C:\Windows\System\ESHpLZx.exe
  2⤵
  PID:3300
- C:\Windows\System\vFbuWNA.exe
  C:\Windows\System\vFbuWNA.exe
  2⤵
  PID:3104
- C:\Windows\System\DFipExS.exe
  C:\Windows\System\DFipExS.exe
  2⤵
  PID:3408
- C:\Windows\System\xHEXTka.exe
  C:\Windows\System\xHEXTka.exe
  2⤵
  PID:3152
- C:\Windows\System\zUbploG.exe
  C:\Windows\System\zUbploG.exe
  2⤵
  PID:3412
- C:\Windows\System\gkeXWYr.exe
  C:\Windows\System\gkeXWYr.exe
  2⤵
  PID:3272
- C:\Windows\System\olpqOTv.exe
  C:\Windows\System\olpqOTv.exe
  2⤵
  PID:3284
- C:\Windows\System\wTbNPfc.exe
  C:\Windows\System\wTbNPfc.exe
  2⤵
  PID:3460
- C:\Windows\System\axZqYnf.exe
  C:\Windows\System\axZqYnf.exe
  2⤵
  PID:3528
- C:\Windows\System\mDzwDiE.exe
  C:\Windows\System\mDzwDiE.exe
  2⤵
  PID:3572
- C:\Windows\System\gBjXkXb.exe
  C:\Windows\System\gBjXkXb.exe
  2⤵
  PID:3636
- C:\Windows\System\BMNkBZv.exe
  C:\Windows\System\BMNkBZv.exe
  2⤵
  PID:3676
- C:\Windows\System\zomlMXw.exe
  C:\Windows\System\zomlMXw.exe
  2⤵
  PID:3736
- C:\Windows\System\ZzLtkKi.exe
  C:\Windows\System\ZzLtkKi.exe
  2⤵
  PID:3800
- C:\Windows\System\xBVoraG.exe
  C:\Windows\System\xBVoraG.exe
  2⤵
  PID:3868
- C:\Windows\System\UZzdFgl.exe
  C:\Windows\System\UZzdFgl.exe
  2⤵
  PID:3932
- C:\Windows\System\sMXgJkT.exe
  C:\Windows\System\sMXgJkT.exe
  2⤵
  PID:4004
- C:\Windows\System\AYDzvSB.exe
  C:\Windows\System\AYDzvSB.exe
  2⤵
  PID:4068
- C:\Windows\System\DGbyGEu.exe
  C:\Windows\System\DGbyGEu.exe
  2⤵
  PID:2700
- C:\Windows\System\XFZNiJN.exe
  C:\Windows\System\XFZNiJN.exe
  2⤵
  PID:2576
- C:\Windows\System\oKkmeCg.exe
  C:\Windows\System\oKkmeCg.exe
  2⤵
  PID:2280
- C:\Windows\System\szLzpCJ.exe
  C:\Windows\System\szLzpCJ.exe
  2⤵
  PID:3392
- C:\Windows\System\ykQjKgM.exe
  C:\Windows\System\ykQjKgM.exe
  2⤵
  PID:2364
- C:\Windows\System\hIcgtiT.exe
  C:\Windows\System\hIcgtiT.exe
  2⤵
  PID:1520
- C:\Windows\System\pOBIhJN.exe
  C:\Windows\System\pOBIhJN.exe
  2⤵
  PID:3432
- C:\Windows\System\nzUKEET.exe
  C:\Windows\System\nzUKEET.exe
  2⤵
  PID:3436
- C:\Windows\System\eZpsPwi.exe
  C:\Windows\System\eZpsPwi.exe
  2⤵
  PID:3356
- C:\Windows\System\eZXjBxp.exe
  C:\Windows\System\eZXjBxp.exe
  2⤵
  PID:2832
- C:\Windows\System\OKoEBHc.exe
  C:\Windows\System\OKoEBHc.exe
  2⤵
  PID:3544
- C:\Windows\System\yBLwwsu.exe
  C:\Windows\System\yBLwwsu.exe
  2⤵
  PID:3784
- C:\Windows\System\IADQgOf.exe
  C:\Windows\System\IADQgOf.exe
  2⤵
  PID:3848
- C:\Windows\System\UsjEHhN.exe
  C:\Windows\System\UsjEHhN.exe
  2⤵
  PID:2824
- C:\Windows\System\YAHEIAz.exe
  C:\Windows\System\YAHEIAz.exe
  2⤵
  PID:3724
- C:\Windows\System\RbqsjAW.exe
  C:\Windows\System\RbqsjAW.exe
  2⤵
  PID:3656
- C:\Windows\System\iFcRxld.exe
  C:\Windows\System\iFcRxld.exe
  2⤵
  PID:3588
- C:\Windows\System\rXzEgaH.exe
  C:\Windows\System\rXzEgaH.exe
  2⤵
  PID:3048
- C:\Windows\System\mNJExCa.exe
  C:\Windows\System\mNJExCa.exe
  2⤵
  PID:3120
- C:\Windows\System\OdycoHT.exe
  C:\Windows\System\OdycoHT.exe
  2⤵
  PID:2984
- C:\Windows\System\VijeFgW.exe
  C:\Windows\System\VijeFgW.exe
  2⤵
  PID:1848
- C:\Windows\System\LwCoaLL.exe
  C:\Windows\System\LwCoaLL.exe
  2⤵
  PID:2680
- C:\Windows\System\btsOGyo.exe
  C:\Windows\System\btsOGyo.exe
  2⤵
  PID:2180
- C:\Windows\System\mARpjEj.exe
  C:\Windows\System\mARpjEj.exe
  2⤵
  PID:2552
- C:\Windows\System\ETNrmpF.exe
  C:\Windows\System\ETNrmpF.exe
  2⤵
  PID:1980
- C:\Windows\System\ptpEjnc.exe
  C:\Windows\System\ptpEjnc.exe
  2⤵
  PID:1496
- C:\Windows\System\vXXZPjW.exe
  C:\Windows\System\vXXZPjW.exe
  2⤵
  PID:3096
- C:\Windows\System\yBbeJNu.exe
  C:\Windows\System\yBbeJNu.exe
  2⤵
  PID:3372
- C:\Windows\System\UKXtJge.exe
  C:\Windows\System\UKXtJge.exe
  2⤵
  PID:4112
- C:\Windows\System\mdXZjNv.exe
  C:\Windows\System\mdXZjNv.exe
  2⤵
  PID:4128
- C:\Windows\System\sQOcelp.exe
  C:\Windows\System\sQOcelp.exe
  2⤵
  PID:4144
- C:\Windows\System\TryMikP.exe
  C:\Windows\System\TryMikP.exe
  2⤵
  PID:4160
- C:\Windows\System\ljLQRbT.exe
  C:\Windows\System\ljLQRbT.exe
  2⤵
  PID:4176
- C:\Windows\System\XStPbdn.exe
  C:\Windows\System\XStPbdn.exe
  2⤵
  PID:4192
- C:\Windows\System\RSQFvjf.exe
  C:\Windows\System\RSQFvjf.exe
  2⤵
  PID:4208
- C:\Windows\System\eSmSORJ.exe
  C:\Windows\System\eSmSORJ.exe
  2⤵
  PID:4224
- C:\Windows\System\GdltFjS.exe
  C:\Windows\System\GdltFjS.exe
  2⤵
  PID:4240
- C:\Windows\System\ABjKRPV.exe
  C:\Windows\System\ABjKRPV.exe
  2⤵
  PID:4256
- C:\Windows\System\btbvCEF.exe
  C:\Windows\System\btbvCEF.exe
  2⤵
  PID:4272
- C:\Windows\System\VmRjIFY.exe
  C:\Windows\System\VmRjIFY.exe
  2⤵
  PID:4288
- C:\Windows\System\NEMuNZd.exe
  C:\Windows\System\NEMuNZd.exe
  2⤵
  PID:4304
- C:\Windows\System\prJXlkp.exe
  C:\Windows\System\prJXlkp.exe
  2⤵
  PID:4320
- C:\Windows\System\iTVIqdW.exe
  C:\Windows\System\iTVIqdW.exe
  2⤵
  PID:4336
- C:\Windows\System\UEmrhVf.exe
  C:\Windows\System\UEmrhVf.exe
  2⤵
  PID:4352
- C:\Windows\System\TQwdAIb.exe
  C:\Windows\System\TQwdAIb.exe
  2⤵
  PID:4580
- C:\Windows\System\QqSTGaK.exe
  C:\Windows\System\QqSTGaK.exe
  2⤵
  PID:4604
- C:\Windows\System\gQKRTXo.exe
  C:\Windows\System\gQKRTXo.exe
  2⤵
  PID:4628
- C:\Windows\System\UdDqVhZ.exe
  C:\Windows\System\UdDqVhZ.exe
  2⤵
  PID:4648
- C:\Windows\System\pSQIDvK.exe
  C:\Windows\System\pSQIDvK.exe
  2⤵
  PID:4664
- C:\Windows\System\EkLHRcR.exe
  C:\Windows\System\EkLHRcR.exe
  2⤵
  PID:4680
- C:\Windows\System\oiPKktn.exe
  C:\Windows\System\oiPKktn.exe
  2⤵
  PID:4696
- C:\Windows\System\qcNLVAr.exe
  C:\Windows\System\qcNLVAr.exe
  2⤵
  PID:4716
- C:\Windows\System\UhBwexw.exe
  C:\Windows\System\UhBwexw.exe
  2⤵
  PID:4732
- C:\Windows\System\PZTXCsr.exe
  C:\Windows\System\PZTXCsr.exe
  2⤵
  PID:4748
- C:\Windows\System\VqfjFhu.exe
  C:\Windows\System\VqfjFhu.exe
  2⤵
  PID:4780
- C:\Windows\System\MxGXoxA.exe
  C:\Windows\System\MxGXoxA.exe
  2⤵
  PID:4800
- C:\Windows\System\OlOiWlf.exe
  C:\Windows\System\OlOiWlf.exe
  2⤵
  PID:4820
- C:\Windows\System\vCochrK.exe
  C:\Windows\System\vCochrK.exe
  2⤵
  PID:4836
- C:\Windows\System\eEYHhTU.exe
  C:\Windows\System\eEYHhTU.exe
  2⤵
  PID:4852
- C:\Windows\System\SzXPFen.exe
  C:\Windows\System\SzXPFen.exe
  2⤵
  PID:4888
- C:\Windows\System\bxRYrSb.exe
  C:\Windows\System\bxRYrSb.exe
  2⤵
  PID:4944
- C:\Windows\System\zDxXNAN.exe
  C:\Windows\System\zDxXNAN.exe
  2⤵
  PID:4960
- C:\Windows\System\cMmJVds.exe
  C:\Windows\System\cMmJVds.exe
  2⤵
  PID:4976
- C:\Windows\System\jApEgRQ.exe
  C:\Windows\System\jApEgRQ.exe
  2⤵
  PID:4996
- C:\Windows\System\Xbzhrwl.exe
  C:\Windows\System\Xbzhrwl.exe
  2⤵
  PID:5016
- C:\Windows\System\VSwFzrw.exe
  C:\Windows\System\VSwFzrw.exe
  2⤵
  PID:2784
- C:\Windows\System\LGbtIry.exe
  C:\Windows\System\LGbtIry.exe
  2⤵
  PID:3084
- C:\Windows\System\wTmLfci.exe
  C:\Windows\System\wTmLfci.exe
  2⤵
  PID:3124
- C:\Windows\System\BWszJvh.exe
  C:\Windows\System\BWszJvh.exe
  2⤵
  PID:3240
- C:\Windows\System\AsZNHwC.exe
  C:\Windows\System\AsZNHwC.exe
  2⤵
  PID:3704
- C:\Windows\System\nfHBhqJ.exe
  C:\Windows\System\nfHBhqJ.exe
  2⤵
  PID:3976
- C:\Windows\System\DXSDMDe.exe
  C:\Windows\System\DXSDMDe.exe
  2⤵
  PID:2964
- C:\Windows\System\ggHMcdf.exe
  C:\Windows\System\ggHMcdf.exe
  2⤵
  PID:3316
- C:\Windows\System\prZSWsI.exe
  C:\Windows\System\prZSWsI.exe
  2⤵
  PID:3456
- C:\Windows\System\nHIcguL.exe
  C:\Windows\System\nHIcguL.exe
  2⤵
  PID:3568
- C:\Windows\System\bxLvWAJ.exe
  C:\Windows\System\bxLvWAJ.exe
  2⤵
  PID:3928
- C:\Windows\System\vkcXxMC.exe
  C:\Windows\System\vkcXxMC.exe
  2⤵
  PID:1104
- C:\Windows\System\MvUIWBx.exe
  C:\Windows\System\MvUIWBx.exe
  2⤵
  PID:1956
- C:\Windows\System\xqyAqzo.exe
  C:\Windows\System\xqyAqzo.exe
  2⤵
  PID:3480
- C:\Windows\System\jqFczzK.exe
  C:\Windows\System\jqFczzK.exe
  2⤵
  PID:3880
- C:\Windows\System\NmVZSBB.exe
  C:\Windows\System\NmVZSBB.exe
  2⤵
  PID:3948
- C:\Windows\System\tKwTKNR.exe
  C:\Windows\System\tKwTKNR.exe
  2⤵
  PID:2376
- C:\Windows\System\dcdObBi.exe
  C:\Windows\System\dcdObBi.exe
  2⤵
  PID:4020
- C:\Windows\System\bKnKDii.exe
  C:\Windows\System\bKnKDii.exe
  2⤵
  PID:1680
- C:\Windows\System\xxFAdKx.exe
  C:\Windows\System\xxFAdKx.exe
  2⤵
  PID:1988
- C:\Windows\System\fJSOfjp.exe
  C:\Windows\System\fJSOfjp.exe
  2⤵
  PID:3044
- C:\Windows\System\WgQBDLy.exe
  C:\Windows\System\WgQBDLy.exe
  2⤵
  PID:1596
- C:\Windows\System\rTVOkWA.exe
  C:\Windows\System\rTVOkWA.exe
  2⤵
  PID:1424
- C:\Windows\System\SdJNkyV.exe
  C:\Windows\System\SdJNkyV.exe
  2⤵
  PID:4140
- C:\Windows\System\EjDsZuF.exe
  C:\Windows\System\EjDsZuF.exe
  2⤵
  PID:4204
- C:\Windows\System\AKYsloa.exe
  C:\Windows\System\AKYsloa.exe
  2⤵
  PID:4268
- C:\Windows\System\VUqQFGY.exe
  C:\Windows\System\VUqQFGY.exe
  2⤵
  PID:4360
- C:\Windows\System\ZHEhUuV.exe
  C:\Windows\System\ZHEhUuV.exe
  2⤵
  PID:4380
- C:\Windows\System\CXiBGcI.exe
  C:\Windows\System\CXiBGcI.exe
  2⤵
  PID:4396
- C:\Windows\System\ujaJncb.exe
  C:\Windows\System\ujaJncb.exe
  2⤵
  PID:4412
- C:\Windows\System\KKsZcaO.exe
  C:\Windows\System\KKsZcaO.exe
  2⤵
  PID:4428
- C:\Windows\System\KzHbkEq.exe
  C:\Windows\System\KzHbkEq.exe
  2⤵
  PID:4444
- C:\Windows\System\cSibwWt.exe
  C:\Windows\System\cSibwWt.exe
  2⤵
  PID:4460
- C:\Windows\System\CyMRYyf.exe
  C:\Windows\System\CyMRYyf.exe
  2⤵
  PID:4476
- C:\Windows\System\eAnBUuA.exe
  C:\Windows\System\eAnBUuA.exe
  2⤵
  PID:4504
- C:\Windows\System\dqcqBRD.exe
  C:\Windows\System\dqcqBRD.exe
  2⤵
  PID:4520
- C:\Windows\System\TBjnpkI.exe
  C:\Windows\System\TBjnpkI.exe
  2⤵
  PID:4536
- C:\Windows\System\oQrCSUM.exe
  C:\Windows\System\oQrCSUM.exe
  2⤵
  PID:3692
- C:\Windows\System\QXECIHx.exe
  C:\Windows\System\QXECIHx.exe
  2⤵
  PID:4564
- C:\Windows\System\KGAIzox.exe
  C:\Windows\System\KGAIzox.exe
  2⤵
  PID:2528
- C:\Windows\System\ClLPpNB.exe
  C:\Windows\System\ClLPpNB.exe
  2⤵
  PID:4152
- C:\Windows\System\kSIzytJ.exe
  C:\Windows\System\kSIzytJ.exe
  2⤵
  PID:4596
- C:\Windows\System\PVuSQiW.exe
  C:\Windows\System\PVuSQiW.exe
  2⤵
  PID:4656
- C:\Windows\System\wdXKrAI.exe
  C:\Windows\System\wdXKrAI.exe
  2⤵
  PID:4644
- C:\Windows\System\aGhRkkk.exe
  C:\Windows\System\aGhRkkk.exe
  2⤵
  PID:2132
- C:\Windows\System\vfcJSbO.exe
  C:\Windows\System\vfcJSbO.exe
  2⤵
  PID:4728
- C:\Windows\System\zSdNCol.exe
  C:\Windows\System\zSdNCol.exe
  2⤵
  PID:4708
- C:\Windows\System\msVhjvi.exe
  C:\Windows\System\msVhjvi.exe
  2⤵
  PID:4744
- C:\Windows\System\ZWppbxW.exe
  C:\Windows\System\ZWppbxW.exe
  2⤵
  PID:4812
- C:\Windows\System\ZSYqqHN.exe
  C:\Windows\System\ZSYqqHN.exe
  2⤵
  PID:4792
- C:\Windows\System\KoUYYtJ.exe
  C:\Windows\System\KoUYYtJ.exe
  2⤵
  PID:4832
- C:\Windows\System\AaVhYLH.exe
  C:\Windows\System\AaVhYLH.exe
  2⤵
  PID:4884
- C:\Windows\System\XldRcow.exe
  C:\Windows\System\XldRcow.exe
  2⤵
  PID:4904
- C:\Windows\System\bTdwmVk.exe
  C:\Windows\System\bTdwmVk.exe
  2⤵
  PID:4916
- C:\Windows\System\KGvNxJb.exe
  C:\Windows\System\KGvNxJb.exe
  2⤵
  PID:3884
- C:\Windows\System\EdsThJh.exe
  C:\Windows\System\EdsThJh.exe
  2⤵
  PID:4952
- C:\Windows\System\kFfMtrE.exe
  C:\Windows\System\kFfMtrE.exe
  2⤵
  PID:4972
- C:\Windows\System\PCLFMob.exe
  C:\Windows\System\PCLFMob.exe
  2⤵
  PID:5004
- C:\Windows\System\XKOOXpZ.exe
  C:\Windows\System\XKOOXpZ.exe
  2⤵
  PID:5044
- C:\Windows\System\WIrWlLc.exe
  C:\Windows\System\WIrWlLc.exe
  2⤵
  PID:5068
- C:\Windows\System\qustLVB.exe
  C:\Windows\System\qustLVB.exe
  2⤵
  PID:5092
- C:\Windows\System\zbBeJxe.exe
  C:\Windows\System\zbBeJxe.exe
  2⤵
  PID:5108
- C:\Windows\System\judTTDX.exe
  C:\Windows\System\judTTDX.exe
  2⤵
  PID:5028
- C:\Windows\System\hrLVFyV.exe
  C:\Windows\System\hrLVFyV.exe
  2⤵
  PID:5052
- C:\Windows\System\EsSDofC.exe
  C:\Windows\System\EsSDofC.exe
  2⤵
  PID:2020
- C:\Windows\System\urISlMT.exe
  C:\Windows\System\urISlMT.exe
  2⤵
  PID:1752
- C:\Windows\System\PHVUKUA.exe
  C:\Windows\System\PHVUKUA.exe
  2⤵
  PID:3340
- C:\Windows\System\JGdHiaO.exe
  C:\Windows\System\JGdHiaO.exe
  2⤵
  PID:3404
- C:\Windows\System\rjUihxh.exe
  C:\Windows\System\rjUihxh.exe
  2⤵
  PID:3836
- C:\Windows\System\sYtuZED.exe
  C:\Windows\System\sYtuZED.exe
  2⤵
  PID:2320
- C:\Windows\System\cpzTTXF.exe
  C:\Windows\System\cpzTTXF.exe
  2⤵
  PID:4236
- C:\Windows\System\IQVVizd.exe
  C:\Windows\System\IQVVizd.exe
  2⤵
  PID:4440
- C:\Windows\System\sprKdSw.exe
  C:\Windows\System\sprKdSw.exe
  2⤵
  PID:3608
- C:\Windows\System\VGZTZWd.exe
  C:\Windows\System\VGZTZWd.exe
  2⤵
  PID:3440
- C:\Windows\System\HmQXsGh.exe
  C:\Windows\System\HmQXsGh.exe
  2⤵
  PID:3388
- C:\Windows\System\OGHeQzt.exe
  C:\Windows\System\OGHeQzt.exe
  2⤵
  PID:2372
- C:\Windows\System\hwHPHqZ.exe
  C:\Windows\System\hwHPHqZ.exe
  2⤵
  PID:3620
- C:\Windows\System\KxkRsUm.exe
  C:\Windows\System\KxkRsUm.exe
  2⤵
  PID:4172
- C:\Windows\System\yGKCuTC.exe
  C:\Windows\System\yGKCuTC.exe
  2⤵
  PID:4388
- C:\Windows\System\DIeqgeS.exe
  C:\Windows\System\DIeqgeS.exe
  2⤵
  PID:4456
- C:\Windows\System\FOoPgWk.exe
  C:\Windows\System\FOoPgWk.exe
  2⤵
  PID:4492
- C:\Windows\System\ApLUNZl.exe
  C:\Windows\System\ApLUNZl.exe
  2⤵
  PID:4556
- C:\Windows\System\vVzNPGv.exe
  C:\Windows\System\vVzNPGv.exe
  2⤵
  PID:4056
- C:\Windows\System\ymhlAEx.exe
  C:\Windows\System\ymhlAEx.exe
  2⤵
  PID:1936
- C:\Windows\System\EMbMFre.exe
  C:\Windows\System\EMbMFre.exe
  2⤵
  PID:1516
- C:\Windows\System\YLkZxuS.exe
  C:\Windows\System\YLkZxuS.exe
  2⤵
  PID:4124
- C:\Windows\System\TlHdfDZ.exe
  C:\Windows\System\TlHdfDZ.exe
  2⤵
  PID:3256
- C:\Windows\System\HjVtHpi.exe
  C:\Windows\System\HjVtHpi.exe
  2⤵
  PID:4252
- C:\Windows\System\qWypUvX.exe
  C:\Windows\System\qWypUvX.exe
  2⤵
  PID:4312
- C:\Windows\System\wHWROER.exe
  C:\Windows\System\wHWROER.exe
  2⤵
  PID:4216
- C:\Windows\System\HgVvlGz.exe
  C:\Windows\System\HgVvlGz.exe
  2⤵
  PID:4592
- C:\Windows\System\iHCpawI.exe
  C:\Windows\System\iHCpawI.exe
  2⤵
  PID:4640
- C:\Windows\System\YQDXofW.exe
  C:\Windows\System\YQDXofW.exe
  2⤵
  PID:5024
- C:\Windows\System\WzNsJVi.exe
  C:\Windows\System\WzNsJVi.exe
  2⤵
  PID:4712
- C:\Windows\System\qPXItBl.exe
  C:\Windows\System\qPXItBl.exe
  2⤵
  PID:4704
- C:\Windows\System\egHXBef.exe
  C:\Windows\System\egHXBef.exe
  2⤵
  PID:4860
- C:\Windows\System\zxajWKl.exe
  C:\Windows\System\zxajWKl.exe
  2⤵
  PID:4876
- C:\Windows\System\PNqQoGu.exe
  C:\Windows\System\PNqQoGu.exe
  2⤵
  PID:4968
- C:\Windows\System\cmPJvBF.exe
  C:\Windows\System\cmPJvBF.exe
  2⤵
  PID:3864
- C:\Windows\System\ZtwhMwP.exe
  C:\Windows\System\ZtwhMwP.exe
  2⤵
  PID:376
- C:\Windows\System\yfYPTue.exe
  C:\Windows\System\yfYPTue.exe
  2⤵
  PID:4940
- C:\Windows\System\BzfaCSx.exe
  C:\Windows\System\BzfaCSx.exe
  2⤵
  PID:3244
- C:\Windows\System\zmZDCdy.exe
  C:\Windows\System\zmZDCdy.exe
  2⤵
  PID:5040
- C:\Windows\System\lsoEJNv.exe
  C:\Windows\System\lsoEJNv.exe
  2⤵
  PID:1512
- C:\Windows\System\CDIzJIi.exe
  C:\Windows\System\CDIzJIi.exe
  2⤵
  PID:5064
- C:\Windows\System\WAwugdz.exe
  C:\Windows\System\WAwugdz.exe
  2⤵
  PID:3476
- C:\Windows\System\gSWbBOL.exe
  C:\Windows\System\gSWbBOL.exe
  2⤵
  PID:5080
- C:\Windows\System\RQHKWEl.exe
  C:\Windows\System\RQHKWEl.exe
  2⤵
  PID:3916
- C:\Windows\System\yYROssN.exe
  C:\Windows\System\yYROssN.exe
  2⤵
  PID:3988
- C:\Windows\System\xVCfDWB.exe
  C:\Windows\System\xVCfDWB.exe
  2⤵
  PID:4372
- C:\Windows\System\WukTroA.exe
  C:\Windows\System\WukTroA.exe
  2⤵
  PID:4512
- C:\Windows\System\pGlmrNl.exe
  C:\Windows\System\pGlmrNl.exe
  2⤵
  PID:4568
- C:\Windows\System\xXTTCKw.exe
  C:\Windows\System\xXTTCKw.exe
  2⤵
  PID:3900
- C:\Windows\System\LIDJXgC.exe
  C:\Windows\System\LIDJXgC.exe
  2⤵
  PID:4332
- C:\Windows\System\dgGaExQ.exe
  C:\Windows\System\dgGaExQ.exe
  2⤵
  PID:3672
- C:\Windows\System\GqwyoZq.exe
  C:\Windows\System\GqwyoZq.exe
  2⤵
  PID:2692
- C:\Windows\System\gTRiIMK.exe
  C:\Windows\System\gTRiIMK.exe
  2⤵
  PID:4624
- C:\Windows\System\sYzXErS.exe
  C:\Windows\System\sYzXErS.exe
  2⤵
  PID:4828
- C:\Windows\System\WYuawli.exe
  C:\Windows\System\WYuawli.exe
  2⤵
  PID:5032
- C:\Windows\System\fQeasnl.exe
  C:\Windows\System\fQeasnl.exe
  2⤵
  PID:3524
- C:\Windows\System\vIZGJmL.exe
  C:\Windows\System\vIZGJmL.exe
  2⤵
  PID:4420
- C:\Windows\System\gioOnRP.exe
  C:\Windows\System\gioOnRP.exe
  2⤵
  PID:4532
- C:\Windows\System\RuBymFG.exe
  C:\Windows\System\RuBymFG.exe
  2⤵
  PID:4120
- C:\Windows\System\tJyfuPt.exe
  C:\Windows\System\tJyfuPt.exe
  2⤵
  PID:1144
- C:\Windows\System\NkmRJug.exe
  C:\Windows\System\NkmRJug.exe
  2⤵
  PID:4724
- C:\Windows\System\YbwZBfb.exe
  C:\Windows\System\YbwZBfb.exe
  2⤵
  PID:4808
- C:\Windows\System\Tazqhuy.exe
  C:\Windows\System\Tazqhuy.exe
  2⤵
  PID:5008
- C:\Windows\System\GUqabqH.exe
  C:\Windows\System\GUqabqH.exe
  2⤵
  PID:3472
- C:\Windows\System\fxQiaSE.exe
  C:\Windows\System\fxQiaSE.exe
  2⤵
  PID:5076
- C:\Windows\System\aXyTwiE.exe
  C:\Windows\System\aXyTwiE.exe
  2⤵
  PID:4300
- C:\Windows\System\YjfGRGg.exe
  C:\Windows\System\YjfGRGg.exe
  2⤵
  PID:4088
- C:\Windows\System\KEMLLxW.exe
  C:\Windows\System\KEMLLxW.exe
  2⤵
  PID:3552
- C:\Windows\System\DEIdMyP.exe
  C:\Windows\System\DEIdMyP.exe
  2⤵
  PID:4576
- C:\Windows\System\jBLlKJi.exe
  C:\Windows\System\jBLlKJi.exe
  2⤵
  PID:4912
- C:\Windows\System\FukmtLk.exe
  C:\Windows\System\FukmtLk.exe
  2⤵
  PID:4588
- C:\Windows\System\ykLAILa.exe
  C:\Windows\System\ykLAILa.exe
  2⤵
  PID:3956
- C:\Windows\System\NCgLTyn.exe
  C:\Windows\System\NCgLTyn.exe
  2⤵
  PID:2684
- C:\Windows\System\bSEhJSn.exe
  C:\Windows\System\bSEhJSn.exe
  2⤵
  PID:1604
- C:\Windows\System\WrrFfej.exe
  C:\Windows\System\WrrFfej.exe
  2⤵
  PID:2336
- C:\Windows\System\GuwHOtn.exe
  C:\Windows\System\GuwHOtn.exe
  2⤵
  PID:1620
- C:\Windows\System\LQIBDIw.exe
  C:\Windows\System\LQIBDIw.exe
  2⤵
  PID:5104
- C:\Windows\System\tLqXPfC.exe
  C:\Windows\System\tLqXPfC.exe
  2⤵
  PID:4376
- C:\Windows\System\dBggMWp.exe
  C:\Windows\System\dBggMWp.exe
  2⤵
  PID:4280
- C:\Windows\System\IxyRDVd.exe
  C:\Windows\System\IxyRDVd.exe
  2⤵
  PID:5116
- C:\Windows\System\shAozJe.exe
  C:\Windows\System\shAozJe.exe
  2⤵
  PID:4220
- C:\Windows\System\IxLUVov.exe
  C:\Windows\System\IxLUVov.exe
  2⤵
  PID:3756
- C:\Windows\System\RLbGQJJ.exe
  C:\Windows\System\RLbGQJJ.exe
  2⤵
  PID:4932
- C:\Windows\System\IUGgeeI.exe
  C:\Windows\System\IUGgeeI.exe
  2⤵
  PID:5136
- C:\Windows\System\xxVUfTg.exe
  C:\Windows\System\xxVUfTg.exe
  2⤵
  PID:5228
- C:\Windows\System\wmHyrbE.exe
  C:\Windows\System\wmHyrbE.exe
  2⤵
  PID:5244
- C:\Windows\System\VByQdFW.exe
  C:\Windows\System\VByQdFW.exe
  2⤵
  PID:5260
- C:\Windows\System\WJZiTaE.exe
  C:\Windows\System\WJZiTaE.exe
  2⤵
  PID:5276
- C:\Windows\System\WJEEanT.exe
  C:\Windows\System\WJEEanT.exe
  2⤵
  PID:5292
- C:\Windows\System\eGxaKNE.exe
  C:\Windows\System\eGxaKNE.exe
  2⤵
  PID:5312
- C:\Windows\System\jEMwawF.exe
  C:\Windows\System\jEMwawF.exe
  2⤵
  PID:5328
- C:\Windows\System\ItroqLy.exe
  C:\Windows\System\ItroqLy.exe
  2⤵
  PID:5344
- C:\Windows\System\CXJttnP.exe
  C:\Windows\System\CXJttnP.exe
  2⤵
  PID:5360
- C:\Windows\System\AvnfAXz.exe
  C:\Windows\System\AvnfAXz.exe
  2⤵
  PID:5376
- C:\Windows\System\imzeoHL.exe
  C:\Windows\System\imzeoHL.exe
  2⤵
  PID:5392
- C:\Windows\System\wwaZFTi.exe
  C:\Windows\System\wwaZFTi.exe
  2⤵
  PID:5408
- C:\Windows\System\EFmAEoj.exe
  C:\Windows\System\EFmAEoj.exe
  2⤵
  PID:5424
- C:\Windows\System\aKZyrZk.exe
  C:\Windows\System\aKZyrZk.exe
  2⤵
  PID:5440
- C:\Windows\System\JwHKrnY.exe
  C:\Windows\System\JwHKrnY.exe
  2⤵
  PID:5456
- C:\Windows\System\GPNwGoL.exe
  C:\Windows\System\GPNwGoL.exe
  2⤵
  PID:5472
- C:\Windows\System\GOfiAjw.exe
  C:\Windows\System\GOfiAjw.exe
  2⤵
  PID:5488
- C:\Windows\System\rXGYbuX.exe
  C:\Windows\System\rXGYbuX.exe
  2⤵
  PID:5504
- C:\Windows\System\mMwAzLv.exe
  C:\Windows\System\mMwAzLv.exe
  2⤵
  PID:5520
- C:\Windows\System\rqvxkFK.exe
  C:\Windows\System\rqvxkFK.exe
  2⤵
  PID:5536
- C:\Windows\System\EcJVWxm.exe
  C:\Windows\System\EcJVWxm.exe
  2⤵
  PID:5552
- C:\Windows\System\gUKXaBx.exe
  C:\Windows\System\gUKXaBx.exe
  2⤵
  PID:5568
- C:\Windows\System\EzqJeHl.exe
  C:\Windows\System\EzqJeHl.exe
  2⤵
  PID:5584
- C:\Windows\System\ftoNvBh.exe
  C:\Windows\System\ftoNvBh.exe
  2⤵
  PID:5600
- C:\Windows\System\mkKVnnm.exe
  C:\Windows\System\mkKVnnm.exe
  2⤵
  PID:5616
- C:\Windows\System\ZMPqMmJ.exe
  C:\Windows\System\ZMPqMmJ.exe
  2⤵
  PID:5632
- C:\Windows\System\JkJoOjY.exe
  C:\Windows\System\JkJoOjY.exe
  2⤵
  PID:5648
- C:\Windows\System\bTBRsiN.exe
  C:\Windows\System\bTBRsiN.exe
  2⤵
  PID:5664
- C:\Windows\System\rZJvlIk.exe
  C:\Windows\System\rZJvlIk.exe
  2⤵
  PID:5680
- C:\Windows\System\BErfyGi.exe
  C:\Windows\System\BErfyGi.exe
  2⤵
  PID:5696
- C:\Windows\System\OUUhZzO.exe
  C:\Windows\System\OUUhZzO.exe
  2⤵
  PID:5712
- C:\Windows\System\YAIFbLV.exe
  C:\Windows\System\YAIFbLV.exe
  2⤵
  PID:5728
- C:\Windows\System\CDHaOVP.exe
  C:\Windows\System\CDHaOVP.exe
  2⤵
  PID:5744
- C:\Windows\System\rmQGGXX.exe
  C:\Windows\System\rmQGGXX.exe
  2⤵
  PID:5760
- C:\Windows\System\WpePhhY.exe
  C:\Windows\System\WpePhhY.exe
  2⤵
  PID:5776
- C:\Windows\System\GknNcnL.exe
  C:\Windows\System\GknNcnL.exe
  2⤵
  PID:5792
- C:\Windows\System\RefxnXf.exe
  C:\Windows\System\RefxnXf.exe
  2⤵
  PID:5808
- C:\Windows\System\CYuDout.exe
  C:\Windows\System\CYuDout.exe
  2⤵
  PID:5824
- C:\Windows\System\juzLNow.exe
  C:\Windows\System\juzLNow.exe
  2⤵
  PID:5840
- C:\Windows\System\eAvIuYN.exe
  C:\Windows\System\eAvIuYN.exe
  2⤵
  PID:5856
- C:\Windows\System\doFRMIz.exe
  C:\Windows\System\doFRMIz.exe
  2⤵
  PID:5872
- C:\Windows\System\YCzpPTV.exe
  C:\Windows\System\YCzpPTV.exe
  2⤵
  PID:5888
- C:\Windows\System\zYnUWZA.exe
  C:\Windows\System\zYnUWZA.exe
  2⤵
  PID:5904
- C:\Windows\System\dRhgTQu.exe
  C:\Windows\System\dRhgTQu.exe
  2⤵
  PID:5920
- C:\Windows\System\YnCKlvZ.exe
  C:\Windows\System\YnCKlvZ.exe
  2⤵
  PID:5936
- C:\Windows\System\rtazego.exe
  C:\Windows\System\rtazego.exe
  2⤵
  PID:5952
- C:\Windows\System\RXwWNLF.exe
  C:\Windows\System\RXwWNLF.exe
  2⤵
  PID:5968
- C:\Windows\System\bFsZBsy.exe
  C:\Windows\System\bFsZBsy.exe
  2⤵
  PID:5984
- C:\Windows\System\EbyovAh.exe
  C:\Windows\System\EbyovAh.exe
  2⤵
  PID:6000
- C:\Windows\System\JLkJngj.exe
  C:\Windows\System\JLkJngj.exe
  2⤵
  PID:6016
- C:\Windows\System\vUQAZvu.exe
  C:\Windows\System\vUQAZvu.exe
  2⤵
  PID:6036
- C:\Windows\System\XkkTLKz.exe
  C:\Windows\System\XkkTLKz.exe
  2⤵
  PID:6052
- C:\Windows\System\QEsCzpb.exe
  C:\Windows\System\QEsCzpb.exe
  2⤵
  PID:6068
- C:\Windows\System\qxVqvGF.exe
  C:\Windows\System\qxVqvGF.exe
  2⤵
  PID:6084
- C:\Windows\System\rEfDasm.exe
  C:\Windows\System\rEfDasm.exe
  2⤵
  PID:6100
- C:\Windows\System\GZCTKot.exe
  C:\Windows\System\GZCTKot.exe
  2⤵
  PID:6116
- C:\Windows\System\CJDXdpP.exe
  C:\Windows\System\CJDXdpP.exe
  2⤵
  PID:6136
- C:\Windows\System\aejGChj.exe
  C:\Windows\System\aejGChj.exe
  2⤵
  PID:3992
- C:\Windows\System\VuMcMKg.exe
  C:\Windows\System\VuMcMKg.exe
  2⤵
  PID:3604
- C:\Windows\System\TbKAaDS.exe
  C:\Windows\System\TbKAaDS.exe
  2⤵
  PID:4544
- C:\Windows\System\uVvDfuQ.exe
  C:\Windows\System\uVvDfuQ.exe
  2⤵
  PID:1736
- C:\Windows\System\ZmkozkS.exe
  C:\Windows\System\ZmkozkS.exe
  2⤵
  PID:5156
- C:\Windows\System\SJHAluF.exe
  C:\Windows\System\SJHAluF.exe
  2⤵
  PID:4040
- C:\Windows\System\upBfjYf.exe
  C:\Windows\System\upBfjYf.exe
  2⤵
  PID:5128
- C:\Windows\System\SlSEzwp.exe
  C:\Windows\System\SlSEzwp.exe
  2⤵
  PID:5176
- C:\Windows\System\WKqYxHH.exe
  C:\Windows\System\WKqYxHH.exe
  2⤵
  PID:5192
- C:\Windows\System\PqruWXu.exe
  C:\Windows\System\PqruWXu.exe
  2⤵
  PID:5208
- C:\Windows\System\IfQvPRE.exe
  C:\Windows\System\IfQvPRE.exe
  2⤵
  PID:5236
- C:\Windows\System\CkdDOtQ.exe
  C:\Windows\System\CkdDOtQ.exe
  2⤵
  PID:5284
- C:\Windows\System\QcXpgmD.exe
  C:\Windows\System\QcXpgmD.exe
  2⤵
  PID:5268
- C:\Windows\System\mMSifPn.exe
  C:\Windows\System\mMSifPn.exe
  2⤵
  PID:5324
- C:\Windows\System\ShoexpM.exe
  C:\Windows\System\ShoexpM.exe
  2⤵
  PID:5384
- C:\Windows\System\IzpPQuX.exe
  C:\Windows\System\IzpPQuX.exe
  2⤵
  PID:5336
- C:\Windows\System\SuSoEUa.exe
  C:\Windows\System\SuSoEUa.exe
  2⤵
  PID:5436
- C:\Windows\System\fguYyGJ.exe
  C:\Windows\System\fguYyGJ.exe
  2⤵
  PID:5500
- C:\Windows\System\xdNHvOe.exe
  C:\Windows\System\xdNHvOe.exe
  2⤵
  PID:5480
- C:\Windows\System\EkZfnPy.exe
  C:\Windows\System\EkZfnPy.exe
  2⤵
  PID:5544
- C:\Windows\System\dRBcIZD.exe
  C:\Windows\System\dRBcIZD.exe
  2⤵
  PID:5532
- C:\Windows\System\YHWAXqg.exe
  C:\Windows\System\YHWAXqg.exe
  2⤵
  PID:5628
- C:\Windows\System\rukOurf.exe
  C:\Windows\System\rukOurf.exe
  2⤵
  PID:5608
- C:\Windows\System\boMoYha.exe
  C:\Windows\System\boMoYha.exe
  2⤵
  PID:5672
- C:\Windows\System\pqRKlbi.exe
  C:\Windows\System\pqRKlbi.exe
  2⤵
  PID:5564
- C:\Windows\System\frcHSZr.exe
  C:\Windows\System\frcHSZr.exe
  2⤵
  PID:5740
- C:\Windows\System\nESvXWe.exe
  C:\Windows\System\nESvXWe.exe
  2⤵
  PID:5752
- C:\Windows\System\xuiQANW.exe
  C:\Windows\System\xuiQANW.exe
  2⤵
  PID:5816
- C:\Windows\System\vmekBxe.exe
  C:\Windows\System\vmekBxe.exe
  2⤵
  PID:5832
- C:\Windows\System\iQVMkye.exe
  C:\Windows\System\iQVMkye.exe
  2⤵
  PID:5896
- C:\Windows\System\WRnnftV.exe
  C:\Windows\System\WRnnftV.exe
  2⤵
  PID:5916
- C:\Windows\System\PrFUVyW.exe
  C:\Windows\System\PrFUVyW.exe
  2⤵
  PID:5928
- C:\Windows\System\IHxmiAP.exe
  C:\Windows\System\IHxmiAP.exe
  2⤵
  PID:5992
- C:\Windows\System\hIABXXX.exe
  C:\Windows\System\hIABXXX.exe
  2⤵
  PID:6028
- C:\Windows\System\cFxtiRu.exe
  C:\Windows\System\cFxtiRu.exe
  2⤵
  PID:6092
- C:\Windows\System\gWWstcO.exe
  C:\Windows\System\gWWstcO.exe
  2⤵
  PID:4928
- C:\Windows\System\wjdQUsC.exe
  C:\Windows\System\wjdQUsC.exe
  2⤵
  PID:4528
- C:\Windows\System\mRFSDbw.exe
  C:\Windows\System\mRFSDbw.exe
  2⤵
  PID:5200
- C:\Windows\System\CItANZA.exe
  C:\Windows\System\CItANZA.exe
  2⤵
  PID:5256
- C:\Windows\System\gueFIls.exe
  C:\Windows\System\gueFIls.exe
  2⤵
  PID:5416
- C:\Windows\System\VTFTZmF.exe
  C:\Windows\System\VTFTZmF.exe
  2⤵
  PID:5880
- C:\Windows\System\OsHedte.exe
  C:\Windows\System\OsHedte.exe
  2⤵
  PID:6044
- C:\Windows\System\DFsJUlK.exe
  C:\Windows\System\DFsJUlK.exe
  2⤵
  PID:6108
- C:\Windows\System\pFUyBph.exe
  C:\Windows\System\pFUyBph.exe
  2⤵
  PID:4248
- C:\Windows\System\IJGWfjs.exe
  C:\Windows\System\IJGWfjs.exe
  2⤵
  PID:2540
- C:\Windows\System\TOVthxo.exe
  C:\Windows\System\TOVthxo.exe
  2⤵
  PID:5188
- C:\Windows\System\OFOgwcd.exe
  C:\Windows\System\OFOgwcd.exe
  2⤵
  PID:5288
- C:\Windows\System\yuhrnJV.exe
  C:\Windows\System\yuhrnJV.exe
  2⤵
  PID:5452
- C:\Windows\System\CSVrMBg.exe
  C:\Windows\System\CSVrMBg.exe
  2⤵
  PID:5960
- C:\Windows\System\BdMJFAC.exe
  C:\Windows\System\BdMJFAC.exe
  2⤵
  PID:5468
- C:\Windows\System\sCAPmAD.exe
  C:\Windows\System\sCAPmAD.exe
  2⤵
  PID:5592
- C:\Windows\System\PVnHsJP.exe
  C:\Windows\System\PVnHsJP.exe
  2⤵
  PID:5688
- C:\Windows\System\gVnSrRg.exe
  C:\Windows\System\gVnSrRg.exe
  2⤵
  PID:4688
- C:\Windows\System\zHGXaBY.exe
  C:\Windows\System\zHGXaBY.exe
  2⤵
  PID:5976
- C:\Windows\System\QLSaTMJ.exe
  C:\Windows\System\QLSaTMJ.exe
  2⤵
  PID:6024
- C:\Windows\System\hUNiwBT.exe
  C:\Windows\System\hUNiwBT.exe
  2⤵
  PID:288
- C:\Windows\System\CMdCydp.exe
  C:\Windows\System\CMdCydp.exe
  2⤵
  PID:5308
- C:\Windows\System\SAlxLvw.exe
  C:\Windows\System\SAlxLvw.exe
  2⤵
  PID:5144
- C:\Windows\System\TMtwLLz.exe
  C:\Windows\System\TMtwLLz.exe
  2⤵
  PID:5164
- C:\Windows\System\WCxFDVc.exe
  C:\Windows\System\WCxFDVc.exe
  2⤵
  PID:5560
- C:\Windows\System\JGUGQKS.exe
  C:\Windows\System\JGUGQKS.exe
  2⤵
  PID:5448
- C:\Windows\System\mFCuuZz.exe
  C:\Windows\System\mFCuuZz.exe
  2⤵
  PID:5724
- C:\Windows\System\zpWTJyD.exe
  C:\Windows\System\zpWTJyD.exe
  2⤵
  PID:5772
- C:\Windows\System\NVvreaR.exe
  C:\Windows\System\NVvreaR.exe
  2⤵
  PID:5864
- C:\Windows\System\WdknCUm.exe
  C:\Windows\System\WdknCUm.exe
  2⤵
  PID:6080
- C:\Windows\System\qpagzSz.exe
  C:\Windows\System\qpagzSz.exe
  2⤵
  PID:5784
- C:\Windows\System\FdeQOzd.exe
  C:\Windows\System\FdeQOzd.exe
  2⤵
  PID:5980
- C:\Windows\System\uRiybRp.exe
  C:\Windows\System\uRiybRp.exe
  2⤵
  PID:6152
- C:\Windows\System\iqTbgAk.exe
  C:\Windows\System\iqTbgAk.exe
  2⤵
  PID:6168
- C:\Windows\System\hnGzrNj.exe
  C:\Windows\System\hnGzrNj.exe
  2⤵
  PID:6184
- C:\Windows\System\VwBKOyd.exe
  C:\Windows\System\VwBKOyd.exe
  2⤵
  PID:6204
- C:\Windows\System\JyAqhFF.exe
  C:\Windows\System\JyAqhFF.exe
  2⤵
  PID:6220
- C:\Windows\System\MhFPBYo.exe
  C:\Windows\System\MhFPBYo.exe
  2⤵
  PID:6236
- C:\Windows\System\GqynGKq.exe
  C:\Windows\System\GqynGKq.exe
  2⤵
  PID:6252
- C:\Windows\System\klPWwWe.exe
  C:\Windows\System\klPWwWe.exe
  2⤵
  PID:6272
- C:\Windows\System\fbvkiND.exe
  C:\Windows\System\fbvkiND.exe
  2⤵
  PID:6288
- C:\Windows\System\KDFYtrR.exe
  C:\Windows\System\KDFYtrR.exe
  2⤵
  PID:6312
- C:\Windows\System\fZggGhc.exe
  C:\Windows\System\fZggGhc.exe
  2⤵
  PID:6328
- C:\Windows\System\SvMQDwq.exe
  C:\Windows\System\SvMQDwq.exe
  2⤵
  PID:6344
- C:\Windows\System\fDObRxk.exe
  C:\Windows\System\fDObRxk.exe
  2⤵
  PID:6360
- C:\Windows\System\uKAyIvm.exe
  C:\Windows\System\uKAyIvm.exe
  2⤵
  PID:6376
- C:\Windows\System\VbGoiVG.exe
  C:\Windows\System\VbGoiVG.exe
  2⤵
  PID:6392
- C:\Windows\System\diTnxMQ.exe
  C:\Windows\System\diTnxMQ.exe
  2⤵
  PID:6408
- C:\Windows\System\zgEWTZj.exe
  C:\Windows\System\zgEWTZj.exe
  2⤵
  PID:6424
- C:\Windows\System\QSsYAhN.exe
  C:\Windows\System\QSsYAhN.exe
  2⤵
  PID:6560
- C:\Windows\System\uVCHcES.exe
  C:\Windows\System\uVCHcES.exe
  2⤵
  PID:6576
- C:\Windows\System\BApPgKW.exe
  C:\Windows\System\BApPgKW.exe
  2⤵
  PID:6592
- C:\Windows\System\JcmFCaM.exe
  C:\Windows\System\JcmFCaM.exe
  2⤵
  PID:6608
- C:\Windows\System\NKAuoMY.exe
  C:\Windows\System\NKAuoMY.exe
  2⤵
  PID:6624
- C:\Windows\System\YBaOMvn.exe
  C:\Windows\System\YBaOMvn.exe
  2⤵
  PID:6640
- C:\Windows\System\SihurKV.exe
  C:\Windows\System\SihurKV.exe
  2⤵
  PID:6656
- C:\Windows\System\Ilegzah.exe
  C:\Windows\System\Ilegzah.exe
  2⤵
  PID:6672
- C:\Windows\System\jyPDsdw.exe
  C:\Windows\System\jyPDsdw.exe
  2⤵
  PID:6688
- C:\Windows\System\jdQMGsg.exe
  C:\Windows\System\jdQMGsg.exe
  2⤵
  PID:6704
- C:\Windows\System\ZesIxuA.exe
  C:\Windows\System\ZesIxuA.exe
  2⤵
  PID:6720
- C:\Windows\System\MPiKpxf.exe
  C:\Windows\System\MPiKpxf.exe
  2⤵
  PID:6736
- C:\Windows\System\ZVZPMdH.exe
  C:\Windows\System\ZVZPMdH.exe
  2⤵
  PID:6752
- C:\Windows\System\eKgsrjZ.exe
  C:\Windows\System\eKgsrjZ.exe
  2⤵
  PID:6768
- C:\Windows\System\DHhGwde.exe
  C:\Windows\System\DHhGwde.exe
  2⤵
  PID:6788
- C:\Windows\System\TgLqSSR.exe
  C:\Windows\System\TgLqSSR.exe
  2⤵
  PID:6804
- C:\Windows\System\YXhQsFa.exe
  C:\Windows\System\YXhQsFa.exe
  2⤵
  PID:6820
- C:\Windows\System\NVyPpBE.exe
  C:\Windows\System\NVyPpBE.exe
  2⤵
  PID:6836
- C:\Windows\System\ZiVhhUe.exe
  C:\Windows\System\ZiVhhUe.exe
  2⤵
  PID:6852
- C:\Windows\System\WCjfcGw.exe
  C:\Windows\System\WCjfcGw.exe
  2⤵
  PID:6868
- C:\Windows\System\yBOFFKZ.exe
  C:\Windows\System\yBOFFKZ.exe
  2⤵
  PID:6884
- C:\Windows\System\nxvBUZc.exe
  C:\Windows\System\nxvBUZc.exe
  2⤵
  PID:6900
- C:\Windows\System\Lxdrddm.exe
  C:\Windows\System\Lxdrddm.exe
  2⤵
  PID:6916
- C:\Windows\System\YJtjTit.exe
  C:\Windows\System\YJtjTit.exe
  2⤵
  PID:6932
- C:\Windows\System\DHIApwa.exe
  C:\Windows\System\DHIApwa.exe
  2⤵
  PID:6948
- C:\Windows\System\yfLgpcV.exe
  C:\Windows\System\yfLgpcV.exe
  2⤵
  PID:6964
- C:\Windows\System\UEuvNRE.exe
  C:\Windows\System\UEuvNRE.exe
  2⤵
  PID:6984
- C:\Windows\System\MyQVMyH.exe
  C:\Windows\System\MyQVMyH.exe
  2⤵
  PID:7000
- C:\Windows\System\oGqJbFl.exe
  C:\Windows\System\oGqJbFl.exe
  2⤵
  PID:7016
- C:\Windows\System\HjfdXzr.exe
  C:\Windows\System\HjfdXzr.exe
  2⤵
  PID:7032
- C:\Windows\System\IzfQvqa.exe
  C:\Windows\System\IzfQvqa.exe
  2⤵
  PID:7068
- C:\Windows\System\hfUdASf.exe
  C:\Windows\System\hfUdASf.exe
  2⤵
  PID:7104
- C:\Windows\System\mzSESLw.exe
  C:\Windows\System\mzSESLw.exe
  2⤵
  PID:7148
- C:\Windows\System\FgiYDeF.exe
  C:\Windows\System\FgiYDeF.exe
  2⤵
  PID:7164
- C:\Windows\System\vsODzXI.exe
  C:\Windows\System\vsODzXI.exe
  2⤵
  PID:5356
- C:\Windows\System\rDnnDbw.exe
  C:\Windows\System\rDnnDbw.exe
  2⤵
  PID:5172
- C:\Windows\System\pKxdkMZ.exe
  C:\Windows\System\pKxdkMZ.exe
  2⤵
  PID:6340
- C:\Windows\System\JHoqFgy.exe
  C:\Windows\System\JHoqFgy.exe
  2⤵
  PID:6404
- C:\Windows\System\yRCqzVg.exe
  C:\Windows\System\yRCqzVg.exe
  2⤵
  PID:5580
- C:\Windows\System\vZtaUrQ.exe
  C:\Windows\System\vZtaUrQ.exe
  2⤵
  PID:6064
- C:\Windows\System\xZcNEuf.exe
  C:\Windows\System\xZcNEuf.exe
  2⤵
  PID:1560
- C:\Windows\System\lXkbLPG.exe
  C:\Windows\System\lXkbLPG.exe
  2⤵
  PID:6180
- C:\Windows\System\NMMdeFI.exe
  C:\Windows\System\NMMdeFI.exe
  2⤵
  PID:6248
- C:\Windows\System\gCsnCAD.exe
  C:\Windows\System\gCsnCAD.exe
  2⤵
  PID:6352
- C:\Windows\System\pglxjmr.exe
  C:\Windows\System\pglxjmr.exe
  2⤵
  PID:6420
- C:\Windows\System\XyBPQeh.exe
  C:\Windows\System\XyBPQeh.exe
  2⤵
  PID:5756
- C:\Windows\System\uLdSngd.exe
  C:\Windows\System\uLdSngd.exe
  2⤵
  PID:6192
- C:\Windows\System\hNFSojb.exe
  C:\Windows\System\hNFSojb.exe
  2⤵
  PID:6260
- C:\Windows\System\ofzxMQx.exe
  C:\Windows\System\ofzxMQx.exe
  2⤵
  PID:6304
- C:\Windows\System\biBHtCq.exe
  C:\Windows\System\biBHtCq.exe
  2⤵
  PID:6448
- C:\Windows\System\oVPHfhv.exe
  C:\Windows\System\oVPHfhv.exe
  2⤵
  PID:6464
- C:\Windows\System\MSjsSpJ.exe
  C:\Windows\System\MSjsSpJ.exe
  2⤵
  PID:6480
- C:\Windows\System\cZXYJUX.exe
  C:\Windows\System\cZXYJUX.exe
  2⤵
  PID:6496
- C:\Windows\System\mVuzwwB.exe
  C:\Windows\System\mVuzwwB.exe
  2⤵
  PID:6516
- C:\Windows\System\rIJOtZi.exe
  C:\Windows\System\rIJOtZi.exe
  2⤵
  PID:6536
- C:\Windows\System\ESwyXzo.exe
  C:\Windows\System\ESwyXzo.exe
  2⤵
  PID:6552
- C:\Windows\System\OxOysAH.exe
  C:\Windows\System\OxOysAH.exe
  2⤵
  PID:6572
- C:\Windows\System\DpmMEWK.exe
  C:\Windows\System\DpmMEWK.exe
  2⤵
  PID:6668
- C:\Windows\System\BvNkHPv.exe
  C:\Windows\System\BvNkHPv.exe
  2⤵
  PID:6684
- C:\Windows\System\fsxiehc.exe
  C:\Windows\System\fsxiehc.exe
  2⤵
  PID:6616
- C:\Windows\System\wOphRdg.exe
  C:\Windows\System\wOphRdg.exe
  2⤵
  PID:6716
- C:\Windows\System\rFHwCoM.exe
  C:\Windows\System\rFHwCoM.exe
  2⤵
  PID:6780
- C:\Windows\System\zPewkzI.exe
  C:\Windows\System\zPewkzI.exe
  2⤵
  PID:6876
- C:\Windows\System\dMKbPVC.exe
  C:\Windows\System\dMKbPVC.exe
  2⤵
  PID:6908
- C:\Windows\System\ghYAKlm.exe
  C:\Windows\System\ghYAKlm.exe
  2⤵
  PID:6980
- C:\Windows\System\LQsLSHZ.exe
  C:\Windows\System\LQsLSHZ.exe
  2⤵
  PID:6956
- C:\Windows\System\gLcbWqZ.exe
  C:\Windows\System\gLcbWqZ.exe
  2⤵
  PID:6732
- C:\Windows\System\DLGiTgN.exe
  C:\Windows\System\DLGiTgN.exe
  2⤵
  PID:6860
- C:\Windows\System\LeOTrST.exe
  C:\Windows\System\LeOTrST.exe
  2⤵
  PID:7008
- C:\Windows\System\FUmkxdi.exe
  C:\Windows\System\FUmkxdi.exe
  2⤵
  PID:7012
- C:\Windows\System\EcMHXsN.exe
  C:\Windows\System\EcMHXsN.exe
  2⤵
  PID:7064
- C:\Windows\System\iHZVqxV.exe
  C:\Windows\System\iHZVqxV.exe
  2⤵
  PID:7088
- C:\Windows\System\IsuORFE.exe
  C:\Windows\System\IsuORFE.exe
  2⤵
  PID:7040
- C:\Windows\System\feqxZHn.exe
  C:\Windows\System\feqxZHn.exe
  2⤵
  PID:7060
- C:\Windows\System\JSPgqvL.exe
  C:\Windows\System\JSPgqvL.exe
  2⤵
  PID:7156
- C:\Windows\System\uCVUgJa.exe
  C:\Windows\System\uCVUgJa.exe
  2⤵
  PID:6372
- C:\Windows\System\CACdzgA.exe
  C:\Windows\System\CACdzgA.exe
  2⤵
  PID:7116
- C:\Windows\System\ouyjGHD.exe
  C:\Windows\System\ouyjGHD.exe
  2⤵
  PID:7136
- C:\Windows\System\VlkIfEm.exe
  C:\Windows\System\VlkIfEm.exe
  2⤵
  PID:5404
- C:\Windows\System\OeYRPDO.exe
  C:\Windows\System\OeYRPDO.exe
  2⤵
  PID:5644
- C:\Windows\System\MGmkIrC.exe
  C:\Windows\System\MGmkIrC.exe
  2⤵
  PID:6320
- C:\Windows\System\yObikBm.exe
  C:\Windows\System\yObikBm.exe
  2⤵
  PID:5820
- C:\Windows\System\ZKKmEmM.exe
  C:\Windows\System\ZKKmEmM.exe
  2⤵
  PID:6384
- C:\Windows\System\xVRAark.exe
  C:\Windows\System\xVRAark.exe
  2⤵
  PID:6228
- C:\Windows\System\lnGMBJi.exe
  C:\Windows\System\lnGMBJi.exe
  2⤵
  PID:6472
- C:\Windows\System\NcnOByB.exe
  C:\Windows\System\NcnOByB.exe
  2⤵
  PID:6268
- C:\Windows\System\tdBpXnh.exe
  C:\Windows\System\tdBpXnh.exe
  2⤵
  PID:6504
- C:\Windows\System\ugShWpS.exe
  C:\Windows\System\ugShWpS.exe
  2⤵
  PID:6488
- C:\Windows\System\zYHaGJr.exe
  C:\Windows\System\zYHaGJr.exe
  2⤵
  PID:6940
- C:\Windows\System\HfcBPNo.exe
  C:\Windows\System\HfcBPNo.exe
  2⤵
  PID:6944
- C:\Windows\System\qZEZpeT.exe
  C:\Windows\System\qZEZpeT.exe
  2⤵
  PID:6636
- C:\Windows\System\WUvabgl.exe
  C:\Windows\System\WUvabgl.exe
  2⤵
  PID:6748
- C:\Windows\System\HGwtiLI.exe
  C:\Windows\System\HGwtiLI.exe
  2⤵
  PID:6924
- C:\Windows\System\dAXhfGY.exe
  C:\Windows\System\dAXhfGY.exe
  2⤵
  PID:6864
- C:\Windows\System\kQNxcem.exe
  C:\Windows\System\kQNxcem.exe
  2⤵
  PID:6828
- C:\Windows\System\iVskQNI.exe
  C:\Windows\System\iVskQNI.exe
  2⤵
  PID:7052
- C:\Windows\System\EnflEBf.exe
  C:\Windows\System\EnflEBf.exe
  2⤵
  PID:7124
- C:\Windows\System\kNDDNMn.exe
  C:\Windows\System\kNDDNMn.exe
  2⤵
  PID:6216
- C:\Windows\System\FiLuFfL.exe
  C:\Windows\System\FiLuFfL.exe
  2⤵
  PID:6508
- C:\Windows\System\FMtTZNt.exe
  C:\Windows\System\FMtTZNt.exe
  2⤵
  PID:6848
- C:\Windows\System\vIdgMRv.exe
  C:\Windows\System\vIdgMRv.exe
  2⤵
  PID:6912
- C:\Windows\System\dQABdMP.exe
  C:\Windows\System\dQABdMP.exe
  2⤵
  PID:7048
- C:\Windows\System\TBmZguT.exe
  C:\Windows\System\TBmZguT.exe
  2⤵
  PID:6012
- C:\Windows\System\azsvZAM.exe
  C:\Windows\System\azsvZAM.exe
  2⤵
  PID:6568
- C:\Windows\System\yrNfnaL.exe
  C:\Windows\System\yrNfnaL.exe
  2⤵
  PID:6548
- C:\Windows\System\WMjtkUm.exe
  C:\Windows\System\WMjtkUm.exe
  2⤵
  PID:6844
- C:\Windows\System\XYvLLwd.exe
  C:\Windows\System\XYvLLwd.exe
  2⤵
  PID:6416
- C:\Windows\System\YujdcFp.exe
  C:\Windows\System\YujdcFp.exe
  2⤵
  PID:6528
- C:\Windows\System\rPBXgWh.exe
  C:\Windows\System\rPBXgWh.exe
  2⤵
  PID:6176
- C:\Windows\System\FRuBheH.exe
  C:\Windows\System\FRuBheH.exe
  2⤵
  PID:6444
- C:\Windows\System\RZYRwUC.exe
  C:\Windows\System\RZYRwUC.exe
  2⤵
  PID:6996
- C:\Windows\System\ilDcGev.exe
  C:\Windows\System\ilDcGev.exe
  2⤵
  PID:7128
- C:\Windows\System\ffaWTMf.exe
  C:\Windows\System\ffaWTMf.exe
  2⤵
  PID:7084
- C:\Windows\System\fBDMENX.exe
  C:\Windows\System\fBDMENX.exe
  2⤵
  PID:6664
- C:\Windows\System\EJTvEAh.exe
  C:\Windows\System\EJTvEAh.exe
  2⤵
  PID:6764
- C:\Windows\System\LYYRCml.exe
  C:\Windows\System\LYYRCml.exe
  2⤵
  PID:6700
- C:\Windows\System\CpBiliH.exe
  C:\Windows\System\CpBiliH.exe
  2⤵
  PID:5152
- C:\Windows\System\qFYeseE.exe
  C:\Windows\System\qFYeseE.exe
  2⤵
  PID:7180
- C:\Windows\System\xewrrfv.exe
  C:\Windows\System\xewrrfv.exe
  2⤵
  PID:7204
- C:\Windows\System\Piwlhrm.exe
  C:\Windows\System\Piwlhrm.exe
  2⤵
  PID:7220
- C:\Windows\System\KVoUSOk.exe
  C:\Windows\System\KVoUSOk.exe
  2⤵
  PID:7236
- C:\Windows\System\uVPRMAu.exe
  C:\Windows\System\uVPRMAu.exe
  2⤵
  PID:7252
- C:\Windows\System\adrgKuM.exe
  C:\Windows\System\adrgKuM.exe
  2⤵
  PID:7272
- C:\Windows\System\onuJhgz.exe
  C:\Windows\System\onuJhgz.exe
  2⤵
  PID:7292
- C:\Windows\System\dKahykQ.exe
  C:\Windows\System\dKahykQ.exe
  2⤵
  PID:7308
- C:\Windows\System\ehOnDsh.exe
  C:\Windows\System\ehOnDsh.exe
  2⤵
  PID:7324
- C:\Windows\System\sdrOjMl.exe
  C:\Windows\System\sdrOjMl.exe
  2⤵
  PID:7360
- C:\Windows\System\ZItRYTa.exe
  C:\Windows\System\ZItRYTa.exe
  2⤵
  PID:7376
- C:\Windows\System\FmlPnpf.exe
  C:\Windows\System\FmlPnpf.exe
  2⤵
  PID:7396
- C:\Windows\System\iPTIMdf.exe
  C:\Windows\System\iPTIMdf.exe
  2⤵
  PID:7412
- C:\Windows\System\rhsCuCH.exe
  C:\Windows\System\rhsCuCH.exe
  2⤵
  PID:7428
- C:\Windows\System\mrQauKJ.exe
  C:\Windows\System\mrQauKJ.exe
  2⤵
  PID:7444
- C:\Windows\System\ItURLSH.exe
  C:\Windows\System\ItURLSH.exe
  2⤵
  PID:7460
- C:\Windows\System\EyztkkR.exe
  C:\Windows\System\EyztkkR.exe
  2⤵
  PID:7476
- C:\Windows\System\FjSAlcO.exe
  C:\Windows\System\FjSAlcO.exe
  2⤵
  PID:7496
- C:\Windows\System\jdxcNjO.exe
  C:\Windows\System\jdxcNjO.exe
  2⤵
  PID:7512
- C:\Windows\System\hRCQVpB.exe
  C:\Windows\System\hRCQVpB.exe
  2⤵
  PID:7528
- C:\Windows\System\xIYXAZg.exe
  C:\Windows\System\xIYXAZg.exe
  2⤵
  PID:7544
- C:\Windows\System\ugLLREe.exe
  C:\Windows\System\ugLLREe.exe
  2⤵
  PID:7564
- C:\Windows\System\kzpkmlO.exe
  C:\Windows\System\kzpkmlO.exe
  2⤵
  PID:7580
- C:\Windows\System\wousWYX.exe
  C:\Windows\System\wousWYX.exe
  2⤵
  PID:7596
- C:\Windows\System\WQWYkQJ.exe
  C:\Windows\System\WQWYkQJ.exe
  2⤵
  PID:7612
- C:\Windows\System\pQPMKVd.exe
  C:\Windows\System\pQPMKVd.exe
  2⤵
  PID:7628
- C:\Windows\System\ScEpFxZ.exe
  C:\Windows\System\ScEpFxZ.exe
  2⤵
  PID:7644
- C:\Windows\System\lnBGBSF.exe
  C:\Windows\System\lnBGBSF.exe
  2⤵
  PID:7660
- C:\Windows\System\iDbFbTG.exe
  C:\Windows\System\iDbFbTG.exe
  2⤵
  PID:7676
- C:\Windows\System\JpEKqlh.exe
  C:\Windows\System\JpEKqlh.exe
  2⤵
  PID:7696
- C:\Windows\System\xGFxrkU.exe
  C:\Windows\System\xGFxrkU.exe
  2⤵
  PID:7712
- C:\Windows\System\zlakGWV.exe
  C:\Windows\System\zlakGWV.exe
  2⤵
  PID:7728
- C:\Windows\System\XGirFKK.exe
  C:\Windows\System\XGirFKK.exe
  2⤵
  PID:7744
- C:\Windows\System\qKxlBIp.exe
  C:\Windows\System\qKxlBIp.exe
  2⤵
  PID:7760
- C:\Windows\System\SzSZGSi.exe
  C:\Windows\System\SzSZGSi.exe
  2⤵
  PID:7776
- C:\Windows\System\DjUbBTx.exe
  C:\Windows\System\DjUbBTx.exe
  2⤵
  PID:7792
- C:\Windows\System\LkpWgtc.exe
  C:\Windows\System\LkpWgtc.exe
  2⤵
  PID:7812
- C:\Windows\System\RUbCfTe.exe
  C:\Windows\System\RUbCfTe.exe
  2⤵
  PID:7828
- C:\Windows\System\AIxWSuK.exe
  C:\Windows\System\AIxWSuK.exe
  2⤵
  PID:7848
- C:\Windows\System\amNBufo.exe
  C:\Windows\System\amNBufo.exe
  2⤵
  PID:7864
- C:\Windows\System\pHVfGxh.exe
  C:\Windows\System\pHVfGxh.exe
  2⤵
  PID:7880
- C:\Windows\System\udigeJA.exe
  C:\Windows\System\udigeJA.exe
  2⤵
  PID:7896
- C:\Windows\System\eHwFlzD.exe
  C:\Windows\System\eHwFlzD.exe
  2⤵
  PID:7912
- C:\Windows\System\XCKBYAm.exe
  C:\Windows\System\XCKBYAm.exe
  2⤵
  PID:7928
- C:\Windows\System\DlnLkln.exe
  C:\Windows\System\DlnLkln.exe
  2⤵
  PID:7948
- C:\Windows\System\NHmdTKN.exe
  C:\Windows\System\NHmdTKN.exe
  2⤵
  PID:7964
- C:\Windows\System\ELCSinK.exe
  C:\Windows\System\ELCSinK.exe
  2⤵
  PID:7980
- C:\Windows\System\jWZscom.exe
  C:\Windows\System\jWZscom.exe
  2⤵
  PID:7996
- C:\Windows\System\RnusMtk.exe
  C:\Windows\System\RnusMtk.exe
  2⤵
  PID:8012
- C:\Windows\System\iWyVpNb.exe
  C:\Windows\System\iWyVpNb.exe
  2⤵
  PID:8028
- C:\Windows\System\UBfCHjT.exe
  C:\Windows\System\UBfCHjT.exe
  2⤵
  PID:8048
- C:\Windows\System\PCldonM.exe
  C:\Windows\System\PCldonM.exe
  2⤵
  PID:8064
- C:\Windows\System\KlEAWvI.exe
  C:\Windows\System\KlEAWvI.exe
  2⤵
  PID:8080
- C:\Windows\System\irYkNrO.exe
  C:\Windows\System\irYkNrO.exe
  2⤵
  PID:8096
- C:\Windows\System\xIcftjK.exe
  C:\Windows\System\xIcftjK.exe
  2⤵
  PID:8112
- C:\Windows\System\XuVDCAl.exe
  C:\Windows\System\XuVDCAl.exe
  2⤵
  PID:8128
- C:\Windows\System\TrYbznB.exe
  C:\Windows\System\TrYbznB.exe
  2⤵
  PID:8144
- C:\Windows\System\OoXxuCG.exe
  C:\Windows\System\OoXxuCG.exe
  2⤵
  PID:8160
- C:\Windows\System\WZdXEkI.exe
  C:\Windows\System\WZdXEkI.exe
  2⤵
  PID:8176
- C:\Windows\System\yFpOMEM.exe
  C:\Windows\System\yFpOMEM.exe
  2⤵
  PID:6244
- C:\Windows\System\jEmKYbV.exe
  C:\Windows\System\jEmKYbV.exe
  2⤵
  PID:4284
- C:\Windows\System\VeEnDqG.exe
  C:\Windows\System\VeEnDqG.exe
  2⤵
  PID:7176
- C:\Windows\System\kzjNZfJ.exe
  C:\Windows\System\kzjNZfJ.exe
  2⤵
  PID:6456
- C:\Windows\System\LxTkeqF.exe
  C:\Windows\System\LxTkeqF.exe
  2⤵
  PID:7200
- C:\Windows\System\WrXpspn.exe
  C:\Windows\System\WrXpspn.exe
  2⤵
  PID:7284
- C:\Windows\System\RxFyWLO.exe
  C:\Windows\System\RxFyWLO.exe
  2⤵
  PID:7316
- C:\Windows\System\tdYdrRO.exe
  C:\Windows\System\tdYdrRO.exe
  2⤵
  PID:7320
- C:\Windows\System\CjkkTnJ.exe
  C:\Windows\System\CjkkTnJ.exe
  2⤵
  PID:7304
- C:\Windows\System\XSoIMcH.exe
  C:\Windows\System\XSoIMcH.exe
  2⤵
  PID:7348
- C:\Windows\System\TCweDRc.exe
  C:\Windows\System\TCweDRc.exe
  2⤵
  PID:7404
- C:\Windows\System\tEMmWUe.exe
  C:\Windows\System\tEMmWUe.exe
  2⤵
  PID:7468
- C:\Windows\System\JzzWgdZ.exe
  C:\Windows\System\JzzWgdZ.exe
  2⤵
  PID:7536
- C:\Windows\System\BfnZAvN.exe
  C:\Windows\System\BfnZAvN.exe
  2⤵
  PID:7576
- C:\Windows\System\TOVRvEP.exe
  C:\Windows\System\TOVRvEP.exe
  2⤵
  PID:7608
- C:\Windows\System\kVmoxDI.exe
  C:\Windows\System\kVmoxDI.exe
  2⤵
  PID:7672
- C:\Windows\System\CeENfxM.exe
  C:\Windows\System\CeENfxM.exe
  2⤵
  PID:6976
- C:\Windows\System\gtNnLhd.exe
  C:\Windows\System\gtNnLhd.exe
  2⤵
  PID:7492
- C:\Windows\System\XZeQott.exe
  C:\Windows\System\XZeQott.exe
  2⤵
  PID:7736
- C:\Windows\System\dhrUZgC.exe
  C:\Windows\System\dhrUZgC.exe
  2⤵
  PID:7620
- C:\Windows\System\spFgzYx.exe
  C:\Windows\System\spFgzYx.exe
  2⤵
  PID:7560
- C:\Windows\System\CCqhuSc.exe
  C:\Windows\System\CCqhuSc.exe
  2⤵
  PID:7592
- C:\Windows\System\bZPbuSp.exe
  C:\Windows\System\bZPbuSp.exe
  2⤵
  PID:7720
- C:\Windows\System\qMAzZHC.exe
  C:\Windows\System\qMAzZHC.exe
  2⤵
  PID:7836
- C:\Windows\System\GjNdbeZ.exe
  C:\Windows\System\GjNdbeZ.exe
  2⤵
  PID:7904
- C:\Windows\System\ixSjNFL.exe
  C:\Windows\System\ixSjNFL.exe
  2⤵
  PID:7944
- C:\Windows\System\rUkuLBU.exe
  C:\Windows\System\rUkuLBU.exe
  2⤵
  PID:8004
- C:\Windows\System\cyuHaxl.exe
  C:\Windows\System\cyuHaxl.exe
  2⤵
  PID:7824
- C:\Windows\System\aPCFTDc.exe
  C:\Windows\System\aPCFTDc.exe
  2⤵
  PID:7788
- C:\Windows\System\wNTpkYu.exe
  C:\Windows\System\wNTpkYu.exe
  2⤵
  PID:8104
- C:\Windows\System\ECNYSsh.exe
  C:\Windows\System\ECNYSsh.exe
  2⤵
  PID:8168
- C:\Windows\System\SrbKomR.exe
  C:\Windows\System\SrbKomR.exe
  2⤵
  PID:7956
- C:\Windows\System\XmqUSwv.exe
  C:\Windows\System\XmqUSwv.exe
  2⤵
  PID:7212
- C:\Windows\System\dLrSLgr.exe
  C:\Windows\System\dLrSLgr.exe
  2⤵
  PID:7192
- C:\Windows\System\WBkBCge.exe
  C:\Windows\System\WBkBCge.exe
  2⤵
  PID:8024
- C:\Windows\System\uZfIPVr.exe
  C:\Windows\System\uZfIPVr.exe
  2⤵
  PID:8088
- C:\Windows\System\vrZyLNm.exe
  C:\Windows\System\vrZyLNm.exe
  2⤵
  PID:7344
- C:\Windows\System\qhWDYbj.exe
  C:\Windows\System\qhWDYbj.exe
  2⤵
  PID:8124
- C:\Windows\System\emBaMri.exe
  C:\Windows\System\emBaMri.exe
  2⤵
  PID:8188
- C:\Windows\System\hvCquKi.exe
  C:\Windows\System\hvCquKi.exe
  2⤵
  PID:7336
- C:\Windows\System\scrfDMm.exe
  C:\Windows\System\scrfDMm.exe
  2⤵
  PID:7196
- C:\Windows\System\iQuFPCy.exe
  C:\Windows\System\iQuFPCy.exe
  2⤵
  PID:7368
- C:\Windows\System\cyUaQkE.exe
  C:\Windows\System\cyUaQkE.exe
  2⤵
  PID:7424
- C:\Windows\System\wPElSYP.exe
  C:\Windows\System\wPElSYP.exe
  2⤵
  PID:7908
- C:\Windows\System\XfVzKeH.exe
  C:\Windows\System\XfVzKeH.exe
  2⤵
  PID:7556
- C:\Windows\System\gMtpolR.exe
  C:\Windows\System\gMtpolR.exe
  2⤵
  PID:7708
- C:\Windows\System\vbLbkaj.exe
  C:\Windows\System\vbLbkaj.exe
  2⤵
  PID:7688
- C:\Windows\System\cpMCDqw.exe
  C:\Windows\System\cpMCDqw.exe
  2⤵
  PID:8036
- C:\Windows\System\jyKVDmB.exe
  C:\Windows\System\jyKVDmB.exe
  2⤵
  PID:8076
- C:\Windows\System\sGrgPwh.exe
  C:\Windows\System\sGrgPwh.exe
  2⤵
  PID:7860
- C:\Windows\System\lerzaeP.exe
  C:\Windows\System\lerzaeP.exe
  2⤵
  PID:7080
- C:\Windows\System\UhcMeVO.exe
  C:\Windows\System\UhcMeVO.exe
  2⤵
  PID:8152
- C:\Windows\System\TUQuQWo.exe
  C:\Windows\System\TUQuQWo.exe
  2⤵
  PID:8020
- C:\Windows\System\PUuVhdN.exe
  C:\Windows\System\PUuVhdN.exe
  2⤵
  PID:6336
- C:\Windows\System\kSNqPaF.exe
  C:\Windows\System\kSNqPaF.exe
  2⤵
  PID:7172
- C:\Windows\System\JACCNrr.exe
  C:\Windows\System\JACCNrr.exe
  2⤵
  PID:7640
- C:\Windows\System\VYatHvv.exe
  C:\Windows\System\VYatHvv.exe
  2⤵
  PID:7520
- C:\Windows\System\oDqkUgE.exe
  C:\Windows\System\oDqkUgE.exe
  2⤵
  PID:7768
- C:\Windows\System\NgLQDiu.exe
  C:\Windows\System\NgLQDiu.exe
  2⤵
  PID:7456
- C:\Windows\System\DAvkJZn.exe
  C:\Windows\System\DAvkJZn.exe
  2⤵
  PID:7604
- C:\Windows\System\SiQEcoa.exe
  C:\Windows\System\SiQEcoa.exe
  2⤵
  PID:7856
- C:\Windows\System\yCgjlPO.exe
  C:\Windows\System\yCgjlPO.exe
  2⤵
  PID:8060
- C:\Windows\System\DiJCYDP.exe
  C:\Windows\System\DiJCYDP.exe
  2⤵
  PID:8156
- C:\Windows\System\BdrHXgT.exe
  C:\Windows\System\BdrHXgT.exe
  2⤵
  PID:8072
- C:\Windows\System\yxnlYJM.exe
  C:\Windows\System\yxnlYJM.exe
  2⤵
  PID:7356
- C:\Windows\System\xqbaASN.exe
  C:\Windows\System\xqbaASN.exe
  2⤵
  PID:7920
- C:\Windows\System\SCjtgNT.exe
  C:\Windows\System\SCjtgNT.exe
  2⤵
  PID:7892
- C:\Windows\System\IRwcGkE.exe
  C:\Windows\System\IRwcGkE.exe
  2⤵
  PID:7488
- C:\Windows\System\TNwIsIM.exe
  C:\Windows\System\TNwIsIM.exe
  2⤵
  PID:7440
- C:\Windows\System\osIGaka.exe
  C:\Windows\System\osIGaka.exe
  2⤵
  PID:8196
- C:\Windows\System\EjjpBIC.exe
  C:\Windows\System\EjjpBIC.exe
  2⤵
  PID:8212
- C:\Windows\System\JRUGdRL.exe
  C:\Windows\System\JRUGdRL.exe
  2⤵
  PID:8228
- C:\Windows\System\zjprOJu.exe
  C:\Windows\System\zjprOJu.exe
  2⤵
  PID:8244
- C:\Windows\System\fLUnlrC.exe
  C:\Windows\System\fLUnlrC.exe
  2⤵
  PID:8260
- C:\Windows\System\VAKUgEU.exe
  C:\Windows\System\VAKUgEU.exe
  2⤵
  PID:8276
- C:\Windows\System\SAwfGUR.exe
  C:\Windows\System\SAwfGUR.exe
  2⤵
  PID:8292
- C:\Windows\System\PTgkXlM.exe
  C:\Windows\System\PTgkXlM.exe
  2⤵
  PID:8308
- C:\Windows\System\aHqqPOJ.exe
  C:\Windows\System\aHqqPOJ.exe
  2⤵
  PID:8324
- C:\Windows\System\dHGSoWw.exe
  C:\Windows\System\dHGSoWw.exe
  2⤵
  PID:8340
- C:\Windows\System\VpcELmX.exe
  C:\Windows\System\VpcELmX.exe
  2⤵
  PID:8356
- C:\Windows\System\ITJuKqQ.exe
  C:\Windows\System\ITJuKqQ.exe
  2⤵
  PID:8372
- C:\Windows\System\EMeXPnm.exe
  C:\Windows\System\EMeXPnm.exe
  2⤵
  PID:8388
- C:\Windows\System\MfhCtZL.exe
  C:\Windows\System\MfhCtZL.exe
  2⤵
  PID:8404
- C:\Windows\System\FioKVmy.exe
  C:\Windows\System\FioKVmy.exe
  2⤵
  PID:8420
- C:\Windows\System\bGeoMBR.exe
  C:\Windows\System\bGeoMBR.exe
  2⤵
  PID:8436
- C:\Windows\System\SoCYbZa.exe
  C:\Windows\System\SoCYbZa.exe
  2⤵
  PID:8452
- C:\Windows\System\pkByxCi.exe
  C:\Windows\System\pkByxCi.exe
  2⤵
  PID:8468
- C:\Windows\System\IGvEylm.exe
  C:\Windows\System\IGvEylm.exe
  2⤵
  PID:8484
- C:\Windows\System\lcEJULA.exe
  C:\Windows\System\lcEJULA.exe
  2⤵
  PID:8500
- C:\Windows\System\CXDDJXn.exe
  C:\Windows\System\CXDDJXn.exe
  2⤵
  PID:8516
- C:\Windows\System\FmofIaK.exe
  C:\Windows\System\FmofIaK.exe
  2⤵
  PID:8532
- C:\Windows\System\brKWZVn.exe
  C:\Windows\System\brKWZVn.exe
  2⤵
  PID:8552
- C:\Windows\System\iOlODEW.exe
  C:\Windows\System\iOlODEW.exe
  2⤵
  PID:8572
- C:\Windows\System\gPyRWEX.exe
  C:\Windows\System\gPyRWEX.exe
  2⤵
  PID:8588
- C:\Windows\System\SQfuHer.exe
  C:\Windows\System\SQfuHer.exe
  2⤵
  PID:8604
- C:\Windows\System\AVXtbJf.exe
  C:\Windows\System\AVXtbJf.exe
  2⤵
  PID:8620
- C:\Windows\System\RzkJJum.exe
  C:\Windows\System\RzkJJum.exe
  2⤵
  PID:8636
- C:\Windows\System\CIOwAWK.exe
  C:\Windows\System\CIOwAWK.exe
  2⤵
  PID:8652
- C:\Windows\System\wkeLBLP.exe
  C:\Windows\System\wkeLBLP.exe
  2⤵
  PID:8668
- C:\Windows\System\LeCbKmi.exe
  C:\Windows\System\LeCbKmi.exe
  2⤵
  PID:8684
- C:\Windows\System\PxkopWA.exe
  C:\Windows\System\PxkopWA.exe
  2⤵
  PID:8708
- C:\Windows\System\KPgWJUD.exe
  C:\Windows\System\KPgWJUD.exe
  2⤵
  PID:8724
- C:\Windows\System\EDoUwDt.exe
  C:\Windows\System\EDoUwDt.exe
  2⤵
  PID:8740
- C:\Windows\System\viyTUDQ.exe
  C:\Windows\System\viyTUDQ.exe
  2⤵
  PID:8756
- C:\Windows\System\dHruguu.exe
  C:\Windows\System\dHruguu.exe
  2⤵
  PID:8780
- C:\Windows\System\TdOFWOi.exe
  C:\Windows\System\TdOFWOi.exe
  2⤵
  PID:8796
- C:\Windows\System\ERDRjFm.exe
  C:\Windows\System\ERDRjFm.exe
  2⤵
  PID:8812
- C:\Windows\System\YbhIiCI.exe
  C:\Windows\System\YbhIiCI.exe
  2⤵
  PID:8828
- C:\Windows\System\fvWWDKa.exe
  C:\Windows\System\fvWWDKa.exe
  2⤵
  PID:8844
- C:\Windows\System\hfSesgd.exe
  C:\Windows\System\hfSesgd.exe
  2⤵
  PID:8864
- C:\Windows\System\CYQcTck.exe
  C:\Windows\System\CYQcTck.exe
  2⤵
  PID:8880
- C:\Windows\System\YITtOfK.exe
  C:\Windows\System\YITtOfK.exe
  2⤵
  PID:8896
- C:\Windows\System\HlvINAH.exe
  C:\Windows\System\HlvINAH.exe
  2⤵
  PID:8912
- C:\Windows\System\MHSindQ.exe
  C:\Windows\System\MHSindQ.exe
  2⤵
  PID:8928
- C:\Windows\System\aDlEtuF.exe
  C:\Windows\System\aDlEtuF.exe
  2⤵
  PID:8944
- C:\Windows\System\QUYiMTy.exe
  C:\Windows\System\QUYiMTy.exe
  2⤵
  PID:8960
- C:\Windows\System\ACfRSmy.exe
  C:\Windows\System\ACfRSmy.exe
  2⤵
  PID:8980
- C:\Windows\System\kXLityR.exe
  C:\Windows\System\kXLityR.exe
  2⤵
  PID:8996
- C:\Windows\System\lbJMauF.exe
  C:\Windows\System\lbJMauF.exe
  2⤵
  PID:9012
- C:\Windows\System\szdjJuZ.exe
  C:\Windows\System\szdjJuZ.exe
  2⤵
  PID:9028
- C:\Windows\System\IbUNVcf.exe
  C:\Windows\System\IbUNVcf.exe
  2⤵
  PID:9044
- C:\Windows\System\FJLVYDN.exe
  C:\Windows\System\FJLVYDN.exe
  2⤵
  PID:9060
- C:\Windows\System\RvjvjNV.exe
  C:\Windows\System\RvjvjNV.exe
  2⤵
  PID:9076
- C:\Windows\System\hOfELXT.exe
  C:\Windows\System\hOfELXT.exe
  2⤵
  PID:9092
- C:\Windows\System\jVvyDOJ.exe
  C:\Windows\System\jVvyDOJ.exe
  2⤵
  PID:9108
- C:\Windows\System\yoanBgL.exe
  C:\Windows\System\yoanBgL.exe
  2⤵
  PID:9124
- C:\Windows\System\uJrMnxR.exe
  C:\Windows\System\uJrMnxR.exe
  2⤵
  PID:9140
- C:\Windows\System\uikInmo.exe
  C:\Windows\System\uikInmo.exe
  2⤵
  PID:9156
- C:\Windows\System\aXafupA.exe
  C:\Windows\System\aXafupA.exe
  2⤵
  PID:9172
- C:\Windows\System\VSteREe.exe
  C:\Windows\System\VSteREe.exe
  2⤵
  PID:9188
- C:\Windows\System\crAXskf.exe
  C:\Windows\System\crAXskf.exe
  2⤵
  PID:9204
- C:\Windows\System\miSyeaO.exe
  C:\Windows\System\miSyeaO.exe
  2⤵
  PID:8220
- C:\Windows\System\WFJdLMd.exe
  C:\Windows\System\WFJdLMd.exe
  2⤵
  PID:8120
- C:\Windows\System\SKrTinU.exe
  C:\Windows\System\SKrTinU.exe
  2⤵
  PID:8320
- C:\Windows\System\SygGpcA.exe
  C:\Windows\System\SygGpcA.exe
  2⤵
  PID:7572
- C:\Windows\System\sATpJIW.exe
  C:\Windows\System\sATpJIW.exe
  2⤵
  PID:7972
- C:\Windows\System\lJoSkbe.exe
  C:\Windows\System\lJoSkbe.exe
  2⤵
  PID:8208
- C:\Windows\System\ajcTOrn.exe
  C:\Windows\System\ajcTOrn.exe
  2⤵
  PID:8272
- C:\Windows\System\vFNBSjM.exe
  C:\Windows\System\vFNBSjM.exe
  2⤵
  PID:8336
- C:\Windows\System\sOqTJsH.exe
  C:\Windows\System\sOqTJsH.exe
  2⤵
  PID:8400
- C:\Windows\System\ETAYKel.exe
  C:\Windows\System\ETAYKel.exe
  2⤵
  PID:8444
- C:\Windows\System\OVWbwOp.exe
  C:\Windows\System\OVWbwOp.exe
  2⤵
  PID:8432
- C:\Windows\System\iFvfFGu.exe
  C:\Windows\System\iFvfFGu.exe
  2⤵
  PID:8508
- C:\Windows\System\NpZpSqA.exe
  C:\Windows\System\NpZpSqA.exe
  2⤵
  PID:8496
- C:\Windows\System\bLEiLyB.exe
  C:\Windows\System\bLEiLyB.exe
  2⤵
  PID:8616
- C:\Windows\System\TfzsTng.exe
  C:\Windows\System\TfzsTng.exe
  2⤵
  PID:8680
- C:\Windows\System\hzWWZhA.exe
  C:\Windows\System\hzWWZhA.exe
  2⤵
  PID:8568
- C:\Windows\System\llSXdsx.exe
  C:\Windows\System\llSXdsx.exe
  2⤵
  PID:8628
- C:\Windows\System\UCTRyoL.exe
  C:\Windows\System\UCTRyoL.exe
  2⤵
  PID:8692
- C:\Windows\System\GIAnekE.exe
  C:\Windows\System\GIAnekE.exe
  2⤵
  PID:8720
- C:\Windows\System\RjpHsht.exe
  C:\Windows\System\RjpHsht.exe
  2⤵
  PID:8788
- C:\Windows\System\txtlcZZ.exe
  C:\Windows\System\txtlcZZ.exe
  2⤵
  PID:8764
- C:\Windows\System\sCaFwfX.exe
  C:\Windows\System\sCaFwfX.exe
  2⤵
  PID:8776
- C:\Windows\System\wBQVrXt.exe
  C:\Windows\System\wBQVrXt.exe
  2⤵
  PID:8852
- C:\Windows\System\nWRwkns.exe
  C:\Windows\System\nWRwkns.exe
  2⤵
  PID:8888
- C:\Windows\System\kuXQuNy.exe
  C:\Windows\System\kuXQuNy.exe
  2⤵
  PID:8924
- C:\Windows\System\ZSMJpgq.exe
  C:\Windows\System\ZSMJpgq.exe
  2⤵
  PID:8952
- C:\Windows\System\IwbIABU.exe
  C:\Windows\System\IwbIABU.exe
  2⤵
  PID:8904
- C:\Windows\System\GnIEshO.exe
  C:\Windows\System\GnIEshO.exe
  2⤵
  PID:8968
- C:\Windows\System\AMOcDua.exe
  C:\Windows\System\AMOcDua.exe
  2⤵
  PID:9052
- C:\Windows\System\rWMpXVE.exe
  C:\Windows\System\rWMpXVE.exe
  2⤵
  PID:9116
- C:\Windows\System\GaSTlnW.exe
  C:\Windows\System\GaSTlnW.exe
  2⤵
  PID:9180
- C:\Windows\System\SAldSuj.exe
  C:\Windows\System\SAldSuj.exe
  2⤵
  PID:9212
- C:\Windows\System\NZnFzHs.exe
  C:\Windows\System\NZnFzHs.exe
  2⤵
  PID:9100
- C:\Windows\System\IjjQghA.exe
  C:\Windows\System\IjjQghA.exe
  2⤵
  PID:9036
- C:\Windows\System\Gmrttxv.exe
  C:\Windows\System\Gmrttxv.exe
  2⤵
  PID:8240
- C:\Windows\System\lAeTsum.exe
  C:\Windows\System\lAeTsum.exe
  2⤵
  PID:8252
- C:\Windows\System\vahetfU.exe
  C:\Windows\System\vahetfU.exe
  2⤵
  PID:9168
- C:\Windows\System\bEpgjvG.exe
  C:\Windows\System\bEpgjvG.exe
  2⤵
  PID:8384
- C:\Windows\System\fmSqNof.exe
  C:\Windows\System\fmSqNof.exe
  2⤵
  PID:8416
- C:\Windows\System\dHLURSP.exe
  C:\Windows\System\dHLURSP.exe
  2⤵
  PID:8544
- C:\Windows\System\wSrtgog.exe
  C:\Windows\System\wSrtgog.exe
  2⤵
  PID:8584
- C:\Windows\System\ZAhKxZU.exe
  C:\Windows\System\ZAhKxZU.exe
  2⤵
  PID:8524
- C:\Windows\System\OwtFDwN.exe
  C:\Windows\System\OwtFDwN.exe
  2⤵
  PID:8664
- C:\Windows\System\sqZyORH.exe
  C:\Windows\System\sqZyORH.exe
  2⤵
  PID:8704
- C:\Windows\System\MGiJsnS.exe
  C:\Windows\System\MGiJsnS.exe
  2⤵
  PID:8772
- C:\Windows\System\gyKRJXl.exe
  C:\Windows\System\gyKRJXl.exe
  2⤵
  PID:8876
- C:\Windows\System\rNRmvMx.exe
  C:\Windows\System\rNRmvMx.exe
  2⤵
  PID:9020
- C:\Windows\System\HzlUCCK.exe
  C:\Windows\System\HzlUCCK.exe
  2⤵
  PID:8992
- C:\Windows\System\JuhXgqR.exe
  C:\Windows\System\JuhXgqR.exe
  2⤵
  PID:9088
- C:\Windows\System\RIuZUDS.exe
  C:\Windows\System\RIuZUDS.exe
  2⤵
  PID:8560
- C:\Windows\System\XcGWTzx.exe
  C:\Windows\System\XcGWTzx.exe
  2⤵
  PID:9072
- C:\Windows\System\xkDbKHS.exe
  C:\Windows\System\xkDbKHS.exe
  2⤵
  PID:8332
- C:\Windows\System\eFDuMXA.exe
  C:\Windows\System\eFDuMXA.exe
  2⤵
  PID:8600
- C:\Windows\System\vVZsKZS.exe
  C:\Windows\System\vVZsKZS.exe
  2⤵
  PID:8368
- C:\Windows\System\cDYfLkA.exe
  C:\Windows\System\cDYfLkA.exe
  2⤵
  PID:9196
- C:\Windows\System\ahBVWUR.exe
  C:\Windows\System\ahBVWUR.exe
  2⤵
  PID:8732
- C:\Windows\System\sepMApb.exe
  C:\Windows\System\sepMApb.exe
  2⤵
  PID:9004
- C:\Windows\System\nNOCjaG.exe
  C:\Windows\System\nNOCjaG.exe
  2⤵
  PID:8464
- C:\Windows\System\qQdBHgn.exe
  C:\Windows\System\qQdBHgn.exe
  2⤵
  PID:8412
- C:\Windows\System\DrEHHhR.exe
  C:\Windows\System\DrEHHhR.exe
  2⤵
  PID:8860
- C:\Windows\System\ySVazGG.exe
  C:\Windows\System\ySVazGG.exe
  2⤵
  PID:8716
- C:\Windows\System\gPDBDyU.exe
  C:\Windows\System\gPDBDyU.exe
  2⤵
  PID:7808
- C:\Windows\System\wZKwLEm.exe
  C:\Windows\System\wZKwLEm.exe
  2⤵
  PID:8820
- C:\Windows\System\fPiQTLb.exe
  C:\Windows\System\fPiQTLb.exe
  2⤵
  PID:8956
- C:\Windows\System\oUWEIDJ.exe
  C:\Windows\System\oUWEIDJ.exe
  2⤵
  PID:8352
- C:\Windows\System\nahPaCY.exe
  C:\Windows\System\nahPaCY.exe
  2⤵
  PID:8492
- C:\Windows\System\cbzLlGp.exe
  C:\Windows\System\cbzLlGp.exe
  2⤵
  PID:8768
- C:\Windows\System\CdkjxyI.exe
  C:\Windows\System\CdkjxyI.exe
  2⤵
  PID:9184
- C:\Windows\System\xgqwJEv.exe
  C:\Windows\System\xgqwJEv.exe
  2⤵
  PID:9232
- C:\Windows\System\XFBHpIS.exe
  C:\Windows\System\XFBHpIS.exe
  2⤵
  PID:9248
- C:\Windows\System\PUMxsaF.exe
  C:\Windows\System\PUMxsaF.exe
  2⤵
  PID:9264
- C:\Windows\System\aMiBkSX.exe
  C:\Windows\System\aMiBkSX.exe
  2⤵
  PID:9280
- C:\Windows\System\TxhunsB.exe
  C:\Windows\System\TxhunsB.exe
  2⤵
  PID:9296
- C:\Windows\System\IYXUSmv.exe
  C:\Windows\System\IYXUSmv.exe
  2⤵
  PID:9312
- C:\Windows\System\YNfqJuw.exe
  C:\Windows\System\YNfqJuw.exe
  2⤵
  PID:9328
- C:\Windows\System\hPPWzct.exe
  C:\Windows\System\hPPWzct.exe
  2⤵
  PID:9344
- C:\Windows\System\QuywhJH.exe
  C:\Windows\System\QuywhJH.exe
  2⤵
  PID:9360
- C:\Windows\System\OtQVuvo.exe
  C:\Windows\System\OtQVuvo.exe
  2⤵
  PID:9376
- C:\Windows\System\xHQFMBP.exe
  C:\Windows\System\xHQFMBP.exe
  2⤵
  PID:9396
- C:\Windows\System\WWdGExh.exe
  C:\Windows\System\WWdGExh.exe
  2⤵
  PID:9412
- C:\Windows\System\TlLfvHt.exe
  C:\Windows\System\TlLfvHt.exe
  2⤵
  PID:9428
- C:\Windows\System\XKTcAlu.exe
  C:\Windows\System\XKTcAlu.exe
  2⤵
  PID:9444
- C:\Windows\System\nmIwQnG.exe
  C:\Windows\System\nmIwQnG.exe
  2⤵
  PID:9460
- C:\Windows\System\UuqxbRN.exe
  C:\Windows\System\UuqxbRN.exe
  2⤵
  PID:9476
- C:\Windows\System\AorAiDd.exe
  C:\Windows\System\AorAiDd.exe
  2⤵
  PID:9492
- C:\Windows\System\bjtHuMq.exe
  C:\Windows\System\bjtHuMq.exe
  2⤵
  PID:9508
- C:\Windows\System\FrRINyl.exe
  C:\Windows\System\FrRINyl.exe
  2⤵
  PID:9524
- C:\Windows\System\esvoShl.exe
  C:\Windows\System\esvoShl.exe
  2⤵
  PID:9540
- C:\Windows\System\lvpErFE.exe
  C:\Windows\System\lvpErFE.exe
  2⤵
  PID:9556
- C:\Windows\System\admhDJE.exe
  C:\Windows\System\admhDJE.exe
  2⤵
  PID:9572
- C:\Windows\System\EnhGAec.exe
  C:\Windows\System\EnhGAec.exe
  2⤵
  PID:9588
- C:\Windows\System\JiiImyr.exe
  C:\Windows\System\JiiImyr.exe
  2⤵
  PID:9604
- C:\Windows\System\kKQJHVr.exe
  C:\Windows\System\kKQJHVr.exe
  2⤵
  PID:9620
- C:\Windows\System\brxgrPN.exe
  C:\Windows\System\brxgrPN.exe
  2⤵
  PID:9636
- C:\Windows\System\wHgvbOY.exe
  C:\Windows\System\wHgvbOY.exe
  2⤵
  PID:9652
- C:\Windows\System\xbiRGBb.exe
  C:\Windows\System\xbiRGBb.exe
  2⤵
  PID:9668
- C:\Windows\System\ruySGtn.exe
  C:\Windows\System\ruySGtn.exe
  2⤵
  PID:9684
- C:\Windows\System\xtxAnal.exe
  C:\Windows\System\xtxAnal.exe
  2⤵
  PID:9700
- C:\Windows\System\TAlakSn.exe
  C:\Windows\System\TAlakSn.exe
  2⤵
  PID:9716
- C:\Windows\System\oRlfdjd.exe
  C:\Windows\System\oRlfdjd.exe
  2⤵
  PID:9732
- C:\Windows\System\aSYWjYi.exe
  C:\Windows\System\aSYWjYi.exe
  2⤵
  PID:9748
- C:\Windows\System\WQkxVxm.exe
  C:\Windows\System\WQkxVxm.exe
  2⤵
  PID:9764
- C:\Windows\System\BnakljK.exe
  C:\Windows\System\BnakljK.exe
  2⤵
  PID:9780
- C:\Windows\System\yfFtmww.exe
  C:\Windows\System\yfFtmww.exe
  2⤵
  PID:9796
- C:\Windows\System\qXrmZWk.exe
  C:\Windows\System\qXrmZWk.exe
  2⤵
  PID:9812
- C:\Windows\System\aotzDKy.exe
  C:\Windows\System\aotzDKy.exe
  2⤵
  PID:9828
- C:\Windows\System\cbdQRcQ.exe
  C:\Windows\System\cbdQRcQ.exe
  2⤵
  PID:9844
- C:\Windows\System\pYhFmow.exe
  C:\Windows\System\pYhFmow.exe
  2⤵
  PID:9860
- C:\Windows\System\WVcaIdj.exe
  C:\Windows\System\WVcaIdj.exe
  2⤵
  PID:9876
- C:\Windows\System\FtHyARK.exe
  C:\Windows\System\FtHyARK.exe
  2⤵
  PID:9892
- C:\Windows\System\EGYCgKL.exe
  C:\Windows\System\EGYCgKL.exe
  2⤵
  PID:9908
- C:\Windows\System\tseHKPL.exe
  C:\Windows\System\tseHKPL.exe
  2⤵
  PID:9924
- C:\Windows\System\rqIOYgw.exe
  C:\Windows\System\rqIOYgw.exe
  2⤵
  PID:9940
- C:\Windows\System\gnYqiDk.exe
  C:\Windows\System\gnYqiDk.exe
  2⤵
  PID:9956
- C:\Windows\System\WnWZsEM.exe
  C:\Windows\System\WnWZsEM.exe
  2⤵
  PID:9972
- C:\Windows\System\PJCsOXd.exe
  C:\Windows\System\PJCsOXd.exe
  2⤵
  PID:9988
- C:\Windows\System\LURtJjN.exe
  C:\Windows\System\LURtJjN.exe
  2⤵
  PID:10004
- C:\Windows\System\HVOKqGl.exe
  C:\Windows\System\HVOKqGl.exe
  2⤵
  PID:10020
- C:\Windows\System\yJUCgMQ.exe
  C:\Windows\System\yJUCgMQ.exe
  2⤵
  PID:10036
- C:\Windows\System\rgYnfkI.exe
  C:\Windows\System\rgYnfkI.exe
  2⤵
  PID:10052
- C:\Windows\System\TlIOrDH.exe
  C:\Windows\System\TlIOrDH.exe
  2⤵
  PID:10068
- C:\Windows\System\BsIOMcw.exe
  C:\Windows\System\BsIOMcw.exe
  2⤵
  PID:10084
- C:\Windows\System\bFuvVVz.exe
  C:\Windows\System\bFuvVVz.exe
  2⤵
  PID:10100
- C:\Windows\System\kOZALoL.exe
  C:\Windows\System\kOZALoL.exe
  2⤵
  PID:10116
- C:\Windows\System\FHJJkMS.exe
  C:\Windows\System\FHJJkMS.exe
  2⤵
  PID:10132
- C:\Windows\System\hSRaWSj.exe
  C:\Windows\System\hSRaWSj.exe
  2⤵
  PID:10148
- C:\Windows\System\ykaiJaD.exe
  C:\Windows\System\ykaiJaD.exe
  2⤵
  PID:10164
- C:\Windows\System\yRaUMjn.exe
  C:\Windows\System\yRaUMjn.exe
  2⤵
  PID:10180
- C:\Windows\System\TQrMBhn.exe
  C:\Windows\System\TQrMBhn.exe
  2⤵
  PID:10196
- C:\Windows\System\uiOXBis.exe
  C:\Windows\System\uiOXBis.exe
  2⤵
  PID:10212
- C:\Windows\System\bmZyPpn.exe
  C:\Windows\System\bmZyPpn.exe
  2⤵
  PID:10228
- C:\Windows\System\BUwuaOx.exe
  C:\Windows\System\BUwuaOx.exe
  2⤵
  PID:9228
- C:\Windows\System\qkFllbB.exe
  C:\Windows\System\qkFllbB.exe
  2⤵
  PID:9288
- C:\Windows\System\iwHYEqW.exe
  C:\Windows\System\iwHYEqW.exe
  2⤵
  PID:9352
- C:\Windows\System\LtXLyTB.exe
  C:\Windows\System\LtXLyTB.exe
  2⤵
  PID:9240
- C:\Windows\System\RhlQIWK.exe
  C:\Windows\System\RhlQIWK.exe
  2⤵
  PID:9388
- C:\Windows\System\LfqcrVX.exe
  C:\Windows\System\LfqcrVX.exe
  2⤵
  PID:9340
- C:\Windows\System\GRKCPIv.exe
  C:\Windows\System\GRKCPIv.exe
  2⤵
  PID:9408
- C:\Windows\System\ybrZnxD.exe
  C:\Windows\System\ybrZnxD.exe
  2⤵
  PID:9472
- C:\Windows\System\zdLdpQu.exe
  C:\Windows\System\zdLdpQu.exe
  2⤵
  PID:9424
- C:\Windows\System\lXSvdKz.exe
  C:\Windows\System\lXSvdKz.exe
  2⤵
  PID:9488
- C:\Windows\System\WxlgsLT.exe
  C:\Windows\System\WxlgsLT.exe
  2⤵
  PID:9552
- C:\Windows\System\CepkNGx.exe
  C:\Windows\System\CepkNGx.exe
  2⤵
  PID:9616
- C:\Windows\System\paNFhGy.exe
  C:\Windows\System\paNFhGy.exe
  2⤵
  PID:9676
- C:\Windows\System\NQcrrxD.exe
  C:\Windows\System\NQcrrxD.exe
  2⤵
  PID:9596
- C:\Windows\System\KjnfjfC.exe
  C:\Windows\System\KjnfjfC.exe
  2⤵
  PID:9744
- C:\Windows\System\ATNFsOD.exe
  C:\Windows\System\ATNFsOD.exe
  2⤵
  PID:9808
- C:\Windows\System\iRSosMa.exe
  C:\Windows\System\iRSosMa.exe
  2⤵
  PID:9628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AfFCGzv.exe

Filesize
1.8MB

MD5
edf3eb62e0fa4775663a9553f6905d79

SHA1
f4d14284cb108ef790d00bfbe258c8c01728dcce

SHA256
2c9e5cc824d98396e31e89f3d3d0b53b915cfab1fd10e9a22d3927fa08051777

SHA512
06dbefe19efedc35e553bc32c930f7d0bd6ce1e60ff503fb8097be022efeaff614005e024eaf48c189057bd31359c73c6ae430c9f9d85a7e78b44f2942db6baf

Download Submit
C:\Windows\system\CASHPBm.exe

Filesize
1.8MB

MD5
3f4abf3c334a1412a47ec3c4154e8f10

SHA1
dfcaadff5f92971e415feef57ea4ac5c0d783a40

SHA256
642a783832d35a00d7effab35fef5d74d06b9bd50a7b708545ae1bb8db440e89

SHA512
23d4de70070c4808ca621f91d5d810ec576203cb12f5c18c91b23b71030b931129ec14831205be620875394a180d05d6a67d7a669bbe1b5571fa7c0ddd4268c7

Download Submit
C:\Windows\system\CLjOEwp.exe

Filesize
1.8MB

MD5
b994f74107b94ab7afc15a87ccd20d93

SHA1
8c39212987966e58f41ca3d5102bfa22c2ef28e0

SHA256
b14c386d654c09daf5806e0c0a772b8c6749389f679131e899d40b8ad99495bd

SHA512
010f9dc0d1be0c03f1accb1506f35a5931bfb33480bbb2f4e108b68505ffea48ba6e33b2873a22af64abd93cf7b8cb8b50ee2cf2c75775ded60f46488038a840

Download Submit
C:\Windows\system\JQXdLvQ.exe

Filesize
1.8MB

MD5
9067ca9a98a973229cdc4bc8cdeac78c

SHA1
923afe2264c1e50adc57d64b53cf201fd2a9bcbb

SHA256
c49270bb291341b07caf887738e6addb91e96f30d33fbda0176cae3211461c1f

SHA512
3060b7c4e66b423474ac29633c6e57ce1142b10b63a8a652aee52527958e4173eec611e077ac2d0c54a21808ecd440f8122a60f0b39425700b6ca7511bff4ffb

Download Submit
C:\Windows\system\RDHXFcn.exe

Filesize
1.8MB

MD5
f2d8142a6cc13c033e826494bde06a4a

SHA1
631aee53081740e8a06234282173396da62e6963

SHA256
cc052eb4f6f9598bfa2f12f47479983525c9ae6fc33040291a612a1fb627f9ec

SHA512
1205b09df8ef5cb3d90cf74227447d83d69405b90280ccbb366dbb11d9e2fca70ff58ddf7f9986a7f5fe6a33203962ce302a76c00364412f0d2dbdce5e7a0319

Download Submit
C:\Windows\system\UtGfodE.exe

Filesize
1.8MB

MD5
b7157f301ba55c14b7851c3d76d107d4

SHA1
557098b1757f536ce864bf3f623c8fa02215875f

SHA256
5ed6db4978d21602e2444c852672052e99881bc6deef644342c380f860f011f5

SHA512
c38203591484745c3e051d4af0fae3ef11944199dff163771dacba7cb566eef3184e8bf9fe40b1aeec9197af8e6fd7a34728a54537cf06104b3a86c5b8436005

Download Submit
C:\Windows\system\ftDvZOW.exe

Filesize
1.8MB

MD5
9c117cbfe6d594e37eedc17a797f0efe

SHA1
19c4e8b5c5e48eec3b14f6ec6b3163add37608ce

SHA256
13f4cc086ac8a4770c9b9fc0f0ea2611f7e0196e24eab23b202462a3a769540d

SHA512
dafc9ca7ced3d00445f34aa17284a538d9798e7eadd8dd7e2804e69e01ecde2e5e3f976c5573ad6d549f14e94b4970ce55c1d4100d0976eaa60f4ec1f5a09acc

Download Submit
C:\Windows\system\fynhAGJ.exe

Filesize
1.8MB

MD5
e0d9a9d8c776b22ef6021781c571ce98

SHA1
8573cef3d01858e3e097166cd79f2666d4c4b46b

SHA256
89454abb49bd3d7506416d112a634e9464f611493aabfb4750c757cc60127354

SHA512
efe53ed4c508de8e5047c14dfc826aa0b88a08621e90f43af62b18eeda8702d28851624798ad2242c4d457c48b9ab3a978d214f44e8df6aabd61c4a7415711e5

Download Submit
C:\Windows\system\hdmYrEj.exe

Filesize
1.8MB

MD5
f92df23dbf258b5f62f3050e1668199b

SHA1
772638f99bae395937d57ce19cf64e539bdc9b70

SHA256
7dc4dea771b355e8e04b75107c0a582ece6328918d282673f611b34943f7022a

SHA512
01bd8624095bcd61cb2c90e8de2bc40a57ed832e6759b4f4c0d0e7706d9a496b6f3e85caeb1f3e199c0f333d5628e2b9d07f4669eaab6bce45efe96d7d8cd7a5

Download Submit
C:\Windows\system\igMPnfQ.exe

Filesize
1.8MB

MD5
97f175700076f4038bce6863697169d7

SHA1
0842cf8b0f5820148adef6f5da98271b176441de

SHA256
bb11d9b38e71526407bb7182e448a9d54cf20f88aa27be541c190d6b1c49bd65

SHA512
08e5caa83776f5d95b6f81eb3f26fe1526a813f8dd7957d765380dfb2265b22b542193b42970fc892a0a862a26682499052420577232c2cdf1a68597905c3a64

Download Submit
C:\Windows\system\johVWRd.exe

Filesize
1.8MB

MD5
93a2a9aacd9ac49eb35ba1cbf1f27008

SHA1
40a2076725ba974b556c7b4b3aa2a786cb4479f0

SHA256
528676aa72ad90d2421159fa8e33e3685e1cc552986531486800d58ba5a9415e

SHA512
04f5c72d8887ea37bbd6c5dd5fd7ab2e697ca548f948971d1eefaf41bbe0b3020926b0f4fc8484cc1c2899bb72179e31c9592e0e20caea923f9f5902d0178c32

Download Submit
C:\Windows\system\wSDCAvI.exe

Filesize
1.8MB

MD5
385c5132bfcfb9c5edebc9e314dd1d3a

SHA1
5c7a0f14720128d503924bf7e06ac5db97eabee0

SHA256
cc79f9146e951f6e7ceeef49defc2227b72cca27b2497d9d9032b1cf5f49d9ee

SHA512
4cfcfdc5b2cf394c4515f1f7495f7cc9681548df24ef3ec80663d36802e29041f1b7903aaa267ea40504420c946ec7b695270fb2ce6a7c54dcc653a798711150

Download Submit
\Windows\system\EdcvMfg.exe

Filesize
1.8MB

MD5
c8f9d7c841169d28e57c5a8698e2c405

SHA1
aef636a3c5b82009e2745a58a4de5ad70d883031

SHA256
a62e71f254dc6803d181bc82846456ed653c843b97f95af902bec98c1788df33

SHA512
bb0a54cec5a3f586e0f7e32c928dcc40fb2857e9b5c39e8c31dbbb2498d427152ee622246b027456d87da0813fe2b7aeca4683eafa33c4caf267657be6b8cd7a

Download Submit
\Windows\system\KqWyiRK.exe

Filesize
1.8MB

MD5
5146c04d162331976efbe67789731164

SHA1
f94e618e76b97a4440f9fd72c5c4391f7db00863

SHA256
1a08b1bcacd927f326b801b65e1c884de987b9baf5e8036a2a04395b0f65621a

SHA512
f7f24c9375a7844da8f5ba01d14a93fc7109b392f987fb1e51f3dd5f41ec6986953c90c10c512a407beb3093711198eb4dea956d771cfa43b2e79ca9d7a8065e

Download Submit
\Windows\system\MSglKaw.exe

Filesize
1.8MB

MD5
e4b9fa7aa59f4c115004ba35e8b9d12d

SHA1
13631308655c3160566816ab63b23c6aac089b91

SHA256
ec40843da8736efb2f8f01300d9002c1cf09e72bcf451a742d7c85a59ff832fc

SHA512
5e0ac0669f33ad3875f3cf04416c7f14ebfe3cf2096cf2dd6e467d2d9b89a830d2f130d8cc100f2502c799ba1819fb75b41464fc5507a5eed6896d04866d7b8c

Download Submit
\Windows\system\MmhAICd.exe

Filesize
1.8MB

MD5
79a8649c75b173c9d5147b9efa0f4a45

SHA1
9c205d4e1244b0dac49e7a69ad0088d2863a9f00

SHA256
78b5aeb47c4b69312b2424cdaf5dd4edf018dda63547a697d0c5860bc1ae1024

SHA512
4f9cc504dac00088778c11fe94576ded13349c4eb9436a062a54933e8e4caff2bcb20b68965d4697dfd1834daef88039e44b39ad7bb50e018fed4f7d8abde173

Download Submit
\Windows\system\PZYwJgp.exe

Filesize
1.8MB

MD5
0df9b29100f0577261f251da118aa668

SHA1
d14dbb5e59106575b8ae6f0534c99807a8a04eae

SHA256
53fdb76d182fa48e162c332d74c9268eadb2c00a901ef8c746b36ccd8686fa43

SHA512
e53e0942e30833be5d861f6cf680488b1a6cd731fc9d537ea74a12d081385b3fcee62a0ed5fc1381278d5f94ab41c4916f89a0afe9b66b029e07b0497007177b

Download Submit
\Windows\system\PkSeBid.exe

Filesize
1.8MB

MD5
53482d6f0c1b18f645fbba2bd0ca5add

SHA1
17aa8781d5769207a04ee20d29351270a7c7f615

SHA256
fb8fa72af8b20364dd50afdce1ae3b966a637fef87b0f7149e7bcc38a433d340

SHA512
00a5f4de5ef5c1b4003429d59d2ff165de766c4643e2e119d23d29c4a80974d0c4075086a582fd45b8ec2cb5cc9d7af71ae745fbf755987e56b3b36fcd4bc29a

Download Submit
\Windows\system\Uxsyfxz.exe

Filesize
1.8MB

MD5
a48b20b0d936f5293b3ad76eeaaea38e

SHA1
67dc48b2835b45d25af9092d2abee23165d164ee

SHA256
c813a1906efcca6eef675923eefda12316314205025cc04ac628f1090f36a173

SHA512
5d59620904fd952ec996f6a106c697175ce5679641563044baa3c5904437d39df50267e6f1248e4906cdfb6c665f57507b4db63c77cf098f3f5383f52f7d5876

Download Submit
\Windows\system\XeJYhxd.exe

Filesize
1.8MB

MD5
2adfe557b9b5cf91f358000df7f204ad

SHA1
799303fea52ad5b4f6a2f8ac5b64c7bb457e4762

SHA256
52c0fd07fcef67144c0d5c99a5dfa26371cfaf9b544ce21e40f8e2af4e3d03bd

SHA512
73b9b9aae62e97ca5e7b9f9aaa41bb7c4227b86e83fe106213a0be471e991032569ebb169081206e4ac84e66ffd746d9482985d8b90b2004263d9f8eed514fa4

Download Submit
\Windows\system\bPRkdvA.exe

Filesize
1.8MB

MD5
17b6b5d355ff7009a87efed145331025

SHA1
12a6e2b7a91c5d6c6920cc40bccd6d2b6d11849a

SHA256
06bafc0dcff2a5a75104def63e32110da77a04144c4aa73b3c6fc9ee6d7c131f

SHA512
d254eba780de6f6ed31757ee2c5d06876f57ce09df349f5fa445fd212afd92f58e7c0448f11c1cb25e6a82c294ef18602ac6ccc1579fbe16b7c5d734e6094f4e

Download Submit
\Windows\system\dCwRWjz.exe

Filesize
1.8MB

MD5
8871eff510d1ee36edff746b64a0c1e2

SHA1
949d196b98bca441bc106af5dd4c95bd6c097057

SHA256
19b8abf363e363d42103474699583ae108167c835c06dcc1cbd9baa7bc8aa3fa

SHA512
d5438a528b927f9b6dadb1ba326b2988c9b72c8614138f0d8c479e474096bdc4e220a4f2cbcc2382dde932f7ac2fe6b1955b00cc517bab16f52ab6658b536b15

Download Submit
\Windows\system\eFLmLYn.exe

Filesize
1.8MB

MD5
4c1558bbe95b8c61f5995aaee95e2ada

SHA1
3ea75c85baea3f5688f141a059dafc37f7ec2cb2

SHA256
cdead17b61bacea5da8acd36e4b2b861548977e5520d9e0acafea2f43a6dd5b9

SHA512
7fa6044081f6c076d474331d559faa81e93527e3c1db0d19d678c1d459a8557689ac6e6877e6d568775763fd4de0a3843454157080d1b1092a7c322bf2bbd0e0

Download Submit
\Windows\system\fOEMKNC.exe

Filesize
1.8MB

MD5
64cb653afdc62b8a4a129d04108b5d63

SHA1
ff953a19e1a1e38a4c8cea3c1a1dc4748c7ba901

SHA256
101d66516219e802218138e1a09e2616f80e31de30bd909ed6816f3384ee54bd

SHA512
8da9cd02405b4aa19e3e1dd7368a493ba702ee6f8598c58e9ae6cd9913e4cc9cf76fa1b54e67a856c5c84d311e1cfb6a63d933f8c1f56b951ab7bc4e2ad545c4

Download Submit
\Windows\system\fhmLLDV.exe

Filesize
1.8MB

MD5
bcac0a9f151885def7faa3a1208fc89b

SHA1
2dee2e3a38e2a021eeab5d0ec14cf3eb1d5357eb

SHA256
2ad22bd50ffae80b2d5aca0aa46f5faf39bb8babaeb8a17b5c3da84a135f04da

SHA512
ea480fef75597b6ed3a397ab03475a0e8ab8ded91e1e635c83ff8db3e7136ac3fe132f7322ba59c98fcb5892955537090bd3554242e893b3ba1013320e474a3f

Download Submit
\Windows\system\iXARCYz.exe

Filesize
1.8MB

MD5
e0fbaae02e630a4627ddc2d88ecc0369

SHA1
423fcde0dd0df433a9d3612079d2b171845d3825

SHA256
7e6bfaecac12e0a4986b8b57665c2f9974735f766a92c18e68efe409edc88364

SHA512
40af7cb024e97b44bbdf09d4491b793e0c54e6b784c5bc74cc8d0943abfe7c9f9b53af73ebf4138e3565bbce1aee6128f84260dc4e144e89a190e813a484b70a

Download Submit
\Windows\system\iyNOooQ.exe

Filesize
1.8MB

MD5
623b1659611e19dd324731e47b4baf81

SHA1
419562d3bf446509ac7e1b5f33593210314c674a

SHA256
388121a333ffd8973dcc915863cea1e5a9e15f5eeb3592faa3bd36ae7f174a30

SHA512
31f3ec60e955cde9f3314a847ba3d53b509d2b43d6f41e3cca67631423fddac01f537f68dfc436b3ae16815e54fd82c24c864b78e81b528dc3aeb0c2e2c4637f

Download Submit
\Windows\system\lkIBEMx.exe

Filesize
1.8MB

MD5
a6e079d2b4e24933221b48f7cd05eed6

SHA1
5452fc77ebe34e3d9774d8a21798e30c230ed24c

SHA256
a29354244eed6b517410fd866aa901d1bfd75aa68410421e6ec7e5a180443da4

SHA512
2b5c50076e902ef0fb22678d59310b9cabbd41d8b472b581fdd350a8ae5cc55261e128c5304f098f6315f9e177e8bc99a842f94a348a090e5ccc9e2f5ac7a794

Download Submit
\Windows\system\rUnmuff.exe

Filesize
1.8MB

MD5
58f27c73f87e3ec3c9c6a2e2067169c0

SHA1
6896e3065df4190b9f9442a5450c6b731276468e

SHA256
37c1b9d3463174e8c00306cb7d5d5ff38bc2cbeb6c8efb7865f9b2d6d209c20c

SHA512
276f5448490ae95bf8cf12451f4b3abcee1d3f54e6770016065b8f2913f5301c63e165d3701587367a3d8fbe79cb4f4ebb5ecf707e745b8bc080f9c8975acc63

Download Submit
\Windows\system\sfTLFAL.exe

Filesize
1.8MB

MD5
c317ab7779ce882c9292af06bf459907

SHA1
ce1fa71413ac2900882b48fe84502aa7e89fd41b

SHA256
294c9efeacd44db550ed66792fececc88e5dd566caf6afee87a82ba70d1cc07c

SHA512
a9bd4ff3d0c2d92b01f4a926c155e121a24099529c777619fb2f33aa6c58f02fcd7c9d92fec8b123547042c8e33f783b3ae7f2cb42ca9b4861ff0e2813a69c90

Download Submit
\Windows\system\shhlgCR.exe

Filesize
1.8MB

MD5
79a163778c3f2feb5e441fe706c230d6

SHA1
5bcfd64a5a7c70c47c040301f05dab6e756543b2

SHA256
8e760a991e2c01ba2ca31491d2c9228a75daaa11e6328e1bd9993d8f2346179d

SHA512
6ff531af16f6d23c0f4c544600591cd87c2b379d34229e5e5af931b2af47cd5a77d1b80dddc604a221bb7c5ae5fa0c836a6ff484f5a346789f20b491a77a764f

Download Submit
\Windows\system\thylxib.exe

Filesize
1.8MB

MD5
32a46b8f65e95042b0285872dbdaa3b7

SHA1
fd689e2f157d8b0130f543fee29451065a78d3a4

SHA256
21ae375277a0c308298d8595887ed865731775e1b6a2ed64fa1bb1687206cbef

SHA512
44b8050713cc3db3b6070f3e48a71bd8a0f547ddbafe033b2d43ecce6804109f64d18cf3dc91a393364f188078f819f52447d8960f2b2bfc170c9fe5398d9c55

Download Submit
\Windows\system\uKXGvdZ.exe

Filesize
1.8MB

MD5
b4d543a00df72d18f961557e3ab50993

SHA1
edc65182de875f0a276a9d7d9d6660926d3459e0

SHA256
998e9ad2cc8753fa4e99fb0fe72b5001d7dc0021846352e15528c2f43a2f42ca

SHA512
0521c936e5fd54371451659d9ba5f18a7efdc915b8db991b6a72ebb160291a7d87f917a3771d1c1c058f7ce2f3ad25dc1d98a2c10baa3c2d378bb68625d5f2cb

Download Submit
\Windows\system\yQCBSdy.exe

Filesize
1.8MB

MD5
89c331b08311b3a2ad5c5be7f0e2def3

SHA1
ecd5da452c83ecee0933af9f1b6cada541591503

SHA256
c41d0274c0daefe77ff6602311ed27329f22495f510deb09d9768a7756611561

SHA512
c119b53166b6b71e4eb77f78327c63d73e79cb1226914c0b9e3495e4c054f99dd33a535d513392455b487a2de0abc7219e80978105e30d0ad218cc4284f66d50

Download Submit
\Windows\system\yUZSWws.exe

Filesize
1.8MB

MD5
b93238d92b0d9495b00a10f69eef599a

SHA1
47fda07d267fb5baf60e5e97300e2460a8c53d60

SHA256
b4f582a4fd6a745fb5d3143dad7c8193431fc322805e3f3e8295bd1832c2fde3

SHA512
b3bd372d37056b8358f1cafb38f04d3c153cacfb7cb227464ddb17d7f18cb82a11346da2140959d013e48551b27d5c1d19fe98bf81536303c771e971969026d4

Download Submit
\Windows\system\zPeIfwR.exe

Filesize
1.8MB

MD5
ae3138006728a47d7328a3e28f872b8a

SHA1
b18032bc4d1dbeffd1c4e71453112f208e365c96

SHA256
c2862e7e4cc8b61984aa13d2490ffb593fe94ae9e866a630feaa8743ab950932

SHA512
d2463de1156d505ed0db5315b17b41bc1823ccc2cdb5829cc539115ffc33c8138847372edfb25d96b3adcd0e9394d8c80a2375f8e3dfe8988ced83b59ce11c15

Download Submit
memory/1252-7679-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/1252-39-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/1964-33-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/1964-37-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/1964-14-0x000007FEF5CBE000-0x000007FEF5CBF000-memory.dmp

Filesize
4KB

Download
memory/1964-36-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/1964-240-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/1964-48-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/1964-78-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2016-7658-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2016-68-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-38-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2108-7681-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2164-7305-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2164-84-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2532-67-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-7306-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-65-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2560-964-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2560-7307-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2588-89-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2588-7650-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2668-7652-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-73-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-41-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2708-4466-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2752-88-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2752-7649-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2916-99-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-3679-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-71-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2916-962-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2916-72-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-963-0x0000000003500000-0x00000000038F2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-1532-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-1555-0x0000000003500000-0x00000000038F2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-3678-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2916-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2916-40-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2916-0-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2916-83-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2916-85-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2916-69-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2916-44-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-43-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2916-13-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-42-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-70-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download